学习助手（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.3

Overview

This learning assistant is not clearly malicious, but it asks for broad read and command execution powers that are not well scoped to learning tasks.

Install only if you are comfortable granting the skill local file-read and command-execution capability. Prefer running it in a restricted sandbox, avoid giving it sensitive directories or credentials, and require explicit approval before any command, package install, API call, or file write.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:125

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 125
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

bash

pip install requests

Technical Analysis

The setup instructions install requests without a version constraint, integrity hash, lock file, isolated environment requirement, or explicit trusted package index. Dependency resolution can therefore produce different artifacts over time.

The supplied learning-plan example only uses Python standard-library modules, so this installation also appears unnecessary for the documented example. Although requests is a legitimate package and no malicious package source was identified, installing an unconstrained remote dependency introduces avoidable supply-chain and reproducibility risk. Package installation may execute packaging hooks, and later imports execute code supplied by the resolved package.

Attack Path

1. A user or agent follows the environment-preparation instructions.
2. pip resolves the current requests release and its transitive dependencies from the configured package index.
3. If the index, account, release, dependency resolution path, or local package-index configuration has been compromised, a malicious artifact may be selected.
4. Installation hooks or subsequent package imports execute the malicious code with the privileges of the user running pip.

Impact Assessment

Successful exploitation could execute code under the installing user's account. Depending on that account's permissions, the payload could read or modify accessible files, access environment variables and credentials, initiate network connections, or alter the Python environment. There is no evidence that the project currently retrieves a known malicious package.

Remediation

View remediation

Remediation Suggestions

• Remove the installation instruction if requests is not required.
• If it is required, pin an audited version and all transitive dependencies.
• Use a lock file with cryptographic hashes, such as a hash-locked requirements file.
• Install dependencies in an isolated virtual environment using a trusted, explicitly configured package index.
• Apply automated dependency scanning and controlled update procedures.
• Document why each third-party dependency is necessary.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Excessive Read and Command-Execution Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 13–14
Vulnerability Type: Excessive agent tool privileges
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

The same capabilities are also declared in the tool list:

yaml

tools:
  - exec
  - read

Technical Analysis

The skill's primary stated purpose is to generate learning plans, exercises, assessments, and progress guidance. These operations can ordinarily be performed through language-model generation and do not require unrestricted local file reads or shell-command execution.

Granting both read and exec violates least-privilege principles by exposing system capabilities broader than the core educational task requires. The document mentions command allowlisting and avoiding command-line concatenation, but it does not define or enforce an allowlist, filesystem boundary, argument-validation policy, sandbox, or confirmation mechanism.

No directly malicious command or explicit sensitive-file access was found. The risk arises because broad capabilities may be available if untrusted content, prompt injection, or ambiguous instructions cause the agent to invoke them.

Attack Path

1. The skill is loaded with its declared read and exec permissions.
2. An attacker supplies prompt-injection content through a learning topic, referenced document, exercise source, or other user-controlled input.
3. The injected instructions request that the agent inspect local files or execute a command under the pretext of preparing learning material or diagnosing the environment.
4. If the host agent does not independently enforce strict authorization boundaries, it invokes read or exec.
5. The command can access resources available to the agent process or modify files within its effective permission scope.

Impact Assessment

Potential impact includes disclosure of files readable by the agent, expos ...[truncated 428 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec and read from the declared tools when providing model-generated educational content.
• If file access is essential, restrict reads to an explicit project directory and reject traversal, absolute paths, symlinks escaping that directory, and sensitive-file patterns.
• If command execution is essential, expose narrowly scoped operations instead of a general shell.
• Enforce a command allowlist, fixed executable paths, structured arguments, strict input validation, timeouts, resource limits, and a restricted environment.
• Never interpolate user-controlled text into shell command strings.
• Require explicit user confirmation before filesystem access, network activity, package installation, or command execution.
• Run the skill in a sandbox with minimal filesystem, process, credential, and network permissions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest presents this as a learning assistant, but the description explicitly broadens activation to project management, task planning, progress tracking, and team collaboration. That scope expansion can cause the agent to invoke a skill with exec capability for unrelated tasks, violating least privilege and increasing the chance of unintended command use or data access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation advertises generic file processing, API integration, and command execution even though the skill's stated purpose is generating learning plans, exercises, and assessments. This mismatch can mislead an agent or user into authorizing powerful behaviors unrelated to the educational task, creating an opportunity for overbroad file access, network use, or shell execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation language is overly broad and includes common planning, task-tracking, and collaboration requests beyond the learning domain. In agent routing, this can cause the skill to be selected for many unrelated prompts, unnecessarily exposing read/exec capabilities and enabling misuse through prompt confusion.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document states that no extra API key is needed, but later advises handling API keys through environment variables. This inconsistency can confuse users about whether secrets are required, leading to unsafe ad hoc configuration, accidental secret exposure, or unexpected external-service usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown claims file writing capability as part of its operations without a clear user-facing warning or constraints around modifying user data. In an agent setting, undocumented write behavior can lead to accidental overwrites, creation of misleading artifacts, or persistence of sensitive content without informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill claims external API integration without a clear educational need or specification of which services are contacted. Unjustified network capability expands the trust boundary, risks data exfiltration, and may cause users to disclose content under the assumption that the skill is a local learning helper.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Claiming system command execution for a learning-plan assistant is unjustified by the functional scope and grants unnecessary power. In an agent environment, even loosely described exec capability can enable arbitrary shell actions if the skill is invoked outside its intended domain or if later prompts smuggle operational requests into the workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.