Security audit

自主学习助手免费版

Security checks for vulnerabilities and agentic risk

Overview

This web-learning skill is mostly coherent, but it asks for broad local file and command authority that is not clearly needed or scoped for web search and browsing.

Install only if you are comfortable giving this skill command execution plus local read/write/search authority. Prefer a version scoped to web search, fetch, and browser tools only, and avoid using it with sensitive prompts, authenticated browser sessions, private files, or API keys unless you have reviewed and constrained how the agent will use them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill grants `exec` capability and advertises MD+EXEC operation even though its stated purpose is web search, fetch, and browser-assisted learning. That creates an unnecessary path to arbitrary shell command execution, which can be abused to run local commands, pivot beyond web retrieval, access sensitive environment data, or modify the host system if an agent follows the documentation too broadly.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation says the skill's capabilities are covered by web-learning operations, but the manifest also grants undeclared `read`, `write`, `glob`, and `exec` powers. This mismatch is dangerous because it obscures the true privilege level of the skill, increasing the chance that users or orchestrators invoke it under the assumption it only searches the web while it can also inspect or alter local files and execute commands.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation description is broad enough to trigger for generic AI model use, agent orchestration, and LLM applications rather than a narrowly defined web-learning task. Overbroad routing increases the likelihood that this high-privilege skill is invoked in contexts where web access, local file access, or command execution are unnecessary, expanding attack surface and the chance of unintended side effects.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs use of web access, browser interaction, and write/exec-adjacent capabilities without warning about privacy, credential exposure, local file effects, or network risk. In an agent setting, missing safety guidance can lead to silent transmission of sensitive prompts/data to third-party sites or execution of actions with system impact that users did not anticipate.

Static analysis

No suspicious patterns detected.