Security audit

认知学习工具（专业版）

Security checks for vulnerabilities and agentic risk

Overview

This learning skill does not show clear malicious behavior, but it asks for broad file, command, and integration authority without enough scoping or substantiated safeguards.

Review this skill carefully before installing. Use it only for bounded learning workflows, avoid sensitive directories and secrets, do not provide callback URLs unless you trust the endpoint, and require explicit confirmation before any file write, package install, network call, or command execution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The skill advertises generic file reading/writing, API integration, and system command execution even though its stated purpose is a cognitive learning tool. This unnecessary expansion of capability increases the attack surface and could let the skill access local data, invoke external services, or run commands under vague prompts that appear unrelated to learning tasks.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The documentation claims encrypted storage, complete audit logging, multi-tenant isolation, and compliance checks, but the provided implementation shows none of these controls. Security overclaims are dangerous because users may entrust sensitive educational or enterprise data to the skill based on protections that do not actually exist.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill claims batch parallel processing, retries, callbacks/webhooks, progress tracking, and enterprise integration, but the code only demonstrates simple in-memory local operations. This mismatch can cause users to expose data to automation flows or external endpoints under the false assumption that reliability, tracking, and integration safeguards are present.

Vague Triggers

High

Confidence: 90% confidence
Finding: The description uses broad activation language such as improving efficiency, automating workflows, batch processing, and workflow optimization, which can match many ordinary user requests far outside the learning domain. Combined with declared read/exec/write tools, this creates a realistic risk that the skill is invoked in unrelated contexts and performs overly powerful actions.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The examples use short, vague trigger phrases that resemble ordinary conversation rather than narrowly scoped study operations. In a skill with broad tool permissions, vague invocation patterns can lead to accidental activation and unintended access to files, commands, or other side-effecting functionality.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The markdown introduces input handling, callback URLs, file operations, API-style integration, and command execution without prominent warnings about data exfiltration, file modification, or system impact. Users may supply sensitive paths or external endpoints without understanding that the skill can read, write, execute, or transmit data.

Static analysis

No suspicious patterns detected.