个性化学习助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:00 AM UTC
• Version: 1.0.1

Overview

This learning-assistant skill is not clearly malicious, but it asks for broad read, write, and command execution authority while documenting a much broader automation role than its tutoring purpose requires.

Install only if you are comfortable granting a learning assistant broad local file and command execution capability. Prefer using it without CellCog or install the SDK in a restricted virtual environment with a pinned version, and require explicit confirmation before it reads files, writes files, runs commands, or processes private learning materials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:59

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59 and 197
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Evidence

markdown

| CellCog SDK | Python library | Optional | `pip install -U cellcog` |

markdown

A: Run `/cellcog-setup` to install authentication, or manually execute `pip install -U cellcog` and set `CELLCOG_API_KEY`. The agent's built-in LLM can also be used directly for learning assistance.

Technical Analysis

The skill instructs users to install or upgrade cellcog without pinning a reviewed version, verifying package hashes, or specifying a trusted package index. The -U option resolves and installs the latest available compatible release, so the code installed by users can change after this skill has been reviewed.

Python packages may execute build-system or installation-related code and later run with the privileges of the user who imports or invokes them. Consequently, compromise of the package publisher, package repository, or dependency chain could expose users to arbitrary code execution. The alternative /cellcog-setup procedure is not defined by any file in the audited project, so its implementation and security properties cannot be verified from this repository.

This finding does not establish that the current cellcog package is malicious. It identifies an unsafe and mutable dependency acquisition process.

Attack Path

1. A user follows the setup instructions in SKILL.md.
2. The user runs pip install -U cellcog without a version constraint or integrity hash.
3. Pip retrieves the package and its transitive dependencies as they exist at installation time.
4. If the publisher account, package release, repository, or dependency chain has been compromised, attacker-controlled installation or runtime code is installed.
5. That code executes with the permissions of the user or environment perform ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cellcog to a specifically reviewed version rather than using -U, for example:

   bash

   python -m pip install "cellcog==REVIEWED_VERSION"
   

2. Publish a lock file or constraints file containing exact versions for all transitive dependencies.
3. Require package hash verification, such as pip install --require-hashes -r requirements.txt.
4. Specify an approved HTTPS package index and document the expected package publisher and provenance.
5. Recommend installation inside a dedicated virtual environment or restricted container under an unprivileged account.
6. Define and audit the /cellcog-setup procedure within the project before recommending it.
7. Add dependency vulnerability scanning and periodic provenance review to the release process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Excessive Agent Tool Permissions for a Content-Generation Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Violation of least privilege through broad filesystem and command-execution permissions
Risk Level: Medium

Evidence

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill declares unrestricted read, write, and command-execution capabilities even though its primary documented purpose is educational content generation. Most tutoring, language-learning, writing-feedback, and study-guide operations do not require shell execution or filesystem modification.

The document provides no enforceable restrictions on writable paths, readable files, executable commands, subprocess privileges, or sandbox boundaries. It mentions command allowlisting as a security recommendation, but does not implement or define such an allowlist. This creates a capability boundary broader than the skill's core operational requirements.

If an agent interprets untrusted learning content, copied project files, or adversarial user instructions as a request to use these tools, the excessive permissions may convert a content-level attack into command execution or filesystem access. The declaration alone does not prove that unauthorized commands have already executed, but it materially increases the impact of prompt injection, agent mistakes, or malicious task input.

Attack Path

1. The skill is loaded with read, write, and exec capabilities.
2. An attacker supplies a learning request, code sample, project file, or other content containing instructions designed to induce an operational action.
3. The agent interprets the content as authorization to inspect files, create or overwrite files, or execute a command.
4. Because the skill does not define path restrictions, command allowlists, or mandatory confirmation, the agent invokes a broadly privileged tool.
5. The resulting operation accesses or modifies resources available ...[truncated 629 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, write, and read from the default tool set when the skill is used only to generate educational content.
2. Grant tools dynamically only when a user explicitly requests a hands-on project operation that requires them.
3. Run executable examples in an isolated, unprivileged sandbox with no access to host credentials or unrelated files.
4. Restrict reads and writes to a dedicated per-session workspace and prevent path traversal or symbolic-link escapes.
5. Implement an explicit command allowlist and prohibit shell interpolation of user-controlled input.
6. Require user confirmation before commands execute or existing files are created, overwritten, or deleted.
7. Disable outbound network access by default for code execution and permit only narrowly approved destinations when necessary.
8. Treat content from users, project files, and generated examples as untrusted data rather than executable instructions.
9. Record tool invocations in an auditable log while redacting secrets and sensitive file contents.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a personalized learning assistant, but its declared tools (exec, write, read) and description explicitly broaden it into general AI model invocation, agent orchestration, and automation. This mismatch can cause users or calling agents to grant the skill more trust and permissions than its stated purpose warrants, increasing the chance of unsafe command execution or unintended file/system actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance says to use the skill whenever AI model calls, intelligent dialogue, agent orchestration, or LLM applications are needed, which is far broader than a learning assistant. Overbroad trigger language can route unrelated tasks into a skill that has exec, read, and write capabilities, creating an avoidable pathway for privilege misuse and prompt-driven expansion beyond safe educational tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The operational flow instructs users to describe needs in natural language and lets the agent generate outputs without defining concrete trigger boundaries or safety gates. In a skill with execution and file capabilities, vague invocation rules increase the chance that adversarial or accidental prompts will be interpreted as authorization to perform broader actions than intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The later sections advertise generic development, API integration, file batch processing, environment management, and data processing, which materially exceed a learning-assistant use case. In practice, this scope creep makes the skill easier to invoke in unrelated high-privilege contexts, where an LLM-driven workflow may read, modify, or execute against local resources without clear purpose limitations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The FAQ promotes 'agent team' mode for comprehensive learning such as full curricula and multi-source analysis, while the boundary section says a single session should only cover one learning intent and cross-disciplinary questions must be split up. These statements conflict about the intended operational scope of one use of the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.