Security audit

学习助手（专业版）

Security checks for vulnerabilities and agentic risk

Overview

This learning-assistant skill is not malicious, but it asks for broad read/write/command authority and advertises file, API, webhook, batch, audit, and delete-style capabilities that are not clearly scoped or supported by the artifact.

Review before installing. Use this only for learning-plan and exercise-generation tasks, and do not grant broad read/write/exec access for operational automation, file processing, external integrations, or callbacks unless the publisher narrows and documents those behaviors.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill advertises broad capabilities such as file handling, API integration, and command execution, but the included implementation only performs local in-memory learning-plan generation. This mismatch is dangerous because agents or users may grant the skill elevated trust or permissions based on false claims, increasing the chance of unintended tool use, data exposure, or unsafe automation beyond the demonstrated behavior.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The document claims enterprise features including batch processing, parallel execution, auditing, exports, webhooks, and integration without corresponding code or controls. In a skill ecosystem, overstated capabilities can mislead operators into routing sensitive or large-scale workflows through the skill, creating operational and security risk when expected isolation, auditing, or callback protections do not actually exist.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The skill states it supports generic create/query/modify/delete modes, but the provided logic does not implement general CRUD semantics. This is primarily a trust and safety issue: downstream agents may infer broader state-changing authority than intended and invoke the skill in contexts where destructive operations are assumed to be supported or safe.

Vague Triggers

High

Confidence: 96% confidence
Finding: The activation description is so broad that it overlaps with common productivity and automation requests far outside a bounded learning-assistant scope. This is dangerous because overly broad trigger language can cause the skill to activate in unrelated contexts, gaining access to read/write/exec-capable workflows and potentially influencing system-impacting actions under an educational label.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: Claiming applicability to 'any topic' and many business scenarios creates ambiguous trigger boundaries. In the context of a skill with declared read/exec/write tools, ambiguity raises the risk of inappropriate invocation on sensitive requests, where the skill's generic framing could steer agent behavior beyond safe educational assistance.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises file processing, command execution, and external API use without clear, prominent user-facing warnings about privacy, data handling, or system impact. This is dangerous because users may provide sensitive inputs or permit execution without understanding that local files, commands, or network calls could be involved, especially given the declared toolset includes read, exec, and write.

Static analysis

No suspicious patterns detected.