认知学习工具（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.2

Overview

The skill is presented as a learning aid but asks for broad command execution and describes generic automation, file, and API capabilities that are not clearly scoped to studying.

Install only if you are comfortable giving this skill command-execution authority. Prefer a revised version that removes `exec`, removes the unused unpinned package install, and narrows activation to learning tasks such as review scheduling, flashcards, recall practice, and study-load analysis.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:125

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 125
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

bash

pip install requests

Technical Analysis

The setup instructions install requests without a version constraint, lock file, or integrity hash. Consequently, the installed code depends on the mutable state of the configured Python package index at execution time.

Package installation can execute package-controlled build or installation logic with the invoking user's permissions. The risk becomes exploitable if the configured index, package release, dependency resolution process, or network environment is compromised. The demonstrated SM-2 functionality only uses Python standard-library modules, so the audited content does not establish a need for this dependency.

Attack Path

1. A user or agent follows the skill's environment-preparation instructions.
2. The agent executes pip install requests.
3. pip resolves the latest available package and transitive dependencies through its configured indexes.
4. An attacker who has compromised an applicable release, dependency, index, or package-resolution environment supplies malicious package content.
5. Malicious build or installation logic executes under the account running pip.
6. The installed code can retain the same access whenever it is subsequently imported or invoked.

Impact Assessment

Successful exploitation could execute arbitrary code with the permissions of the user or agent running the installation. This may permit access to files, environment variables, credentials, network resources, and other assets available to that account. The scope does not inherently exceed the invoking account's operating-system privileges.

Exploitation requires compromise or hostile control of some part of the package supply chain or package-index configuration; the audited project does not itself contain a malicious ...[truncated 27 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the installation instruction because the included SM-2 example does not use requests.
2. If the dependency is genuinely required, pin an audited version rather than resolving the latest release.
3. Use a lock file containing cryptographic hashes and install with hash verification, such as pip install --require-hashes.
4. Restrict package resolution to an approved, authenticated package index.
5. Review and pin all transitive dependencies.
6. Perform installation inside an isolated virtual environment or sandbox with minimal filesystem and network permissions.
7. Integrate dependency vulnerability and provenance checks into the release process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Broad Command-Execution Permission Exceeds Demonstrated Functional Requirements

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 17–19
Vulnerability Type: Excessive tool permission
Risk Level: Medium

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read

Technical Analysis

The skill grants access to a general command-execution tool through two metadata declarations. Its demonstrated cognitive-learning functionality consists of natural-language processing and a self-contained Python scheduling example; no narrowly defined executable component is provided that requires unrestricted shell access.

General command execution expands the trust boundary from producing educational content to running operating-system commands. Although the document later recommends command allowlisting and avoiding interpolation of user input, the metadata does not technically enforce those restrictions. This creates a least-privilege violation: any unsafe command synthesized from untrusted learning content would execute with the host permissions assigned to the agent.

Attack Path

1. The skill is loaded with its declared exec permission.
2. An attacker supplies learning material or task content containing instructions crafted to influence agent behavior.
3. The agent treats the hostile content as operational guidance and constructs a shell command.
4. The broadly authorized exec tool runs the command because no enforceable command or argument restrictions are defined in the skill metadata.
5. The command accesses or modifies resources available to the agent's operating-system account.

The audited file does not itself direct the agent to execute a malicious command. Exploitation therefore depends on an additional unsafe agent decision or untrusted-content injection.

Impact Assessment

If exploited, command execution could read or modify local files, access environment variables and credentials, initiate network connections, or invoke other programs avai ...[truncated 212 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from both tool declarations if the skill only generates study plans, flashcards, analyses, and review schedules.
2. Replace general shell execution with a narrowly scoped scheduling function that accepts typed and validated parameters.
3. If command execution is unavoidable, enforce an external allowlist of executable paths and fixed argument schemas.
4. Invoke programs directly without a shell and prohibit command interpolation, redirection, pipelines, and command substitution.
5. Validate all user-controlled values against strict type, length, and character constraints.
6. Run permitted commands in a sandbox with a read-only filesystem, restricted network access, minimal environment variables, and no access to user credentials.
7. Require explicit user approval before any command with filesystem, package-management, or network effects.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description uses broad trigger language such as improving efficiency, automation, batch processing, and workflow optimization, which is far wider than a cognitive learning tool's stated domain. Overbroad routing language can cause the skill to be invoked in unrelated contexts where its exec/read permissions and generic capabilities become riskier than users expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a cognitive learning aid, but its documented scope expands into generic automation, file processing, API integration, and command execution. This capability mismatch weakens trust boundaries and can cause an agent or user to grant broader permissions than the learning use case justifies, increasing the chance of misuse or unintended execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Documenting system command execution as a core feature is unjustified for a cognitive learning assistant and materially increases attack surface. In an agent environment, normalizing exec capability can enable filesystem manipulation, environment probing, or command injection chains if future prompts or extensions pass untrusted input into shell commands.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description explicitly states '支持中文交互' and frames the skill around Chinese interaction, while the file does not offer a language choice or indicate that Chinese is optional. This can violate language/locale policy expectations when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The usage scenarios provide a few example commands, but they do not define the full trigger set, exclusions, or constraints for activation. Without explicit boundaries or negative examples, the skill’s invocation logic remains ambiguous, especially given the broader description language earlier in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document says no extra API key is needed, yet elsewhere describes external API integration and API-key handling precautions. These contradictory statements can mislead users and auditors about whether networked services or secrets are involved, undermining informed consent and secure deployment review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Claiming external API integration for a nominally local cognitive learning tool introduces unnecessary outbound communication and data-handling risk. Users may provide study materials or personal notes expecting local processing, while the skill description normalizes external service access without clearly defining what data may leave the environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The feature note says the skill covers '中文交互' as a core capability, but does not mention multilingual support or that the user can choose another language. This reinforces a language-specific behavior without clear opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.