Security audit

kids-homework-helper

Security checks for vulnerabilities and agentic risk

Overview

The homework helper is mostly tutoring guidance, but it also adds a generic persistent learning system that stores usage and preferences and may modify the skill itself.

Review before installing. The core homework guidance is not malicious, but the persistent learner is overbroad for a child-focused tutor. Install only if you are comfortable with local storage of usage history, preferences, and error notes, and with instructions that may modify the skill file after repeated issues. Consider removing or disabling scripts/learner.py and learned_patterns.json behavior unless explicit retention controls are added.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a homework helper, but it also embeds a generic learning/persistence subsystem that records usage, stores preferences, and drives optimization across arbitrary skills. This mismatch is dangerous because it can cause users and operators to grant trust and permissions under a narrow educational pretext while the skill performs broader stateful behavior than disclosed.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The self-evolution module persists user preferences and usage history in `learned_patterns.json`, which exceeds the reasonable expectations for a simple homework tutor. Persistent storage of behavioral data creates privacy and data leakage risk, especially when the retained content can include notes, errors, and user-specific preferences in natural language.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: A tutoring skill that also advertises autonomous self-improvement, persistent memory, and workflow adaptation is materially broader than its user-facing identity. That hidden broadening is risky because it normalizes undisclosed statefulness and creates opportunities for unauthorized retention or future behavior drift under innocuous branding.

Scope Creep

Low

Confidence: 91% confidence
Finding: The instruction to write accumulated experience back into `SKILL.md` introduces self-modifying prompt/document behavior. Self-modification is dangerous because it can persist prompt-injected content, expand unintended capabilities over time, and alter trusted instructions without review, turning transient bad input into durable configuration drift.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The module persists user preferences and usage history to a skill-local JSON file even though the advertised skill is a homework helper, not a stateful telemetry or profiling system. Because this skill targets children, storing behavioral notes, preferences, and recent operations creates unnecessary privacy risk and expands data collection beyond what a user would reasonably expect from the stated functionality.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The file introduces a generic cross-skill self-learning and reflection component that is not directly necessary for solving homework questions. In this context, that broader capability increases the chance of unauthorized data reuse, hidden state accumulation, and scope creep across skills, especially when combined with persistent storage and a child-focused use case.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill describes retaining user preferences and usage history without a clear, front-facing disclosure or consent mechanism. Undisclosed retention is dangerous because users may reveal child-related educational data assuming ephemeral tutoring, while the system silently stores it for later reuse.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Persistently recording preferences, errors, and usage history in a local JSON memory file creates a natural-language data retention and leakage risk. In this context, the skill targets children and parents, making stored learning difficulties, notes, and preferences especially sensitive and increasing the harm from unintended exposure or reuse.

Static analysis

No suspicious patterns detected.