Security audit

dapianke

Security checks for vulnerabilities and agentic risk

Overview

This is a course-design helper that visibly saves and reuses local project notes in a user-chosen folder, with no evidence of hidden code, network access, or credential handling.

Install only if you want a Chinese-language course-design workflow that can create, read, and update markdown files in a project folder you provide. Use a dedicated folder and avoid placing unrelated sensitive documents in that project directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger description is broad enough to activate on common discussions about courses, training, or teaching, which can cause the skill to engage unexpectedly outside narrowly intended scenarios. Because this skill also includes cross-session project persistence and file operations, accidental invocation increases the chance of unanticipated data collection, file reads, or file writes in ordinary conversations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs persistent reading and writing of markdown files in a user-specified directory across sessions, but it does not present an explicit safety notice or consent boundary about these file operations. This creates a meaningful risk of users not understanding that the skill will maintain state, read prior files as context, and update local content repeatedly, which can expose sensitive information or lead to unintended modification of files in chosen paths.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: This markdown file is written entirely in Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a compliance issue when no justification or alternative is provided.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The content explicitly frames persuasion as confrontation and encourages emotionally charged opposition as a teaching advantage, without any guardrails about audience suitability, ethics, or non-coercive alternatives. In a course-design skill that may be reused to generate real sales or training content, this can normalize manipulative rhetoric and push users toward adversarial influence tactics rather than informed, consent-based communication.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The entire skill file is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The document is written entirely in Chinese and presents its methodology as a reusable reference for other skills, which can impose a Chinese-only interaction pattern if adopted downstream. There is no indication that users may choose another language or that the locale restriction is intentionally limited to a Chinese-specific context.

Static analysis

No suspicious patterns detected.