Back to skill

Security audit

Ielts Speaking Mock Exam

Security checks for vulnerabilities and agentic risk

Overview

This is a simple IELTS speaking practice skill with no code execution, data access, persistence, or hidden privileged behavior.

Install this if you want a Chinese-guided IELTS speaking mock exam that conducts the exam mainly in English. It does not appear to access local files, credentials, external services, or persistent agent settings.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The display name and description are entirely in Chinese, which indicates the skill is presented in a fixed language/locale. There is no accompanying text offering user language choice or explaining that the skill is intentionally limited to Chinese-speaking users, so this appears to violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instructions explicitly require the AI to begin '用中文' for the rules explanation, which forces a specific language choice. Although the skill is IELTS-focused, the file does not present this as an opt-in language preference or offer alternatives, making it a natural-language locale policy issue under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The rule says the mock exam '应保持全英文提问', restricting the interaction language to English for most of the session. Even if pedagogically motivated, the policy provided for this audit requires either explicit user choice/opt-in or clearly justified documentation of the locale constraint; here it is imposed as a blanket rule.

Content

No source excerpt is available for this finding.