kids learning English Vocabulary

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:17 AM UTC
• Version: 1.0.0

Overview

This vocabulary-learning skill is educational, but it asks agents to install unpinned Python packages into the shared system environment, so users should review it before use.

Install only if you are comfortable with the agent creating lesson image files and changing the Python environment. Prefer running it in an isolated environment or revising the install step to use pinned dependencies in a virtual environment before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:225

Finding

Unpinned Runtime Dependency Installation into the System Python Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:225
Vulnerability Type: Supply-chain exposure through mutable, unverified dependencies
Risk Level: Medium

Complete Code Snippet:

text

1. `pip install pillow matplotlib --break-system-packages -q`

Technical Analysis

The skill directs the agent to install the latest available versions of pillow and matplotlib at runtime without exact version pins, package hashes, a lock file, or an isolated virtual environment. Consequently, the dependencies reviewed today may differ from those installed during a future invocation.

The --break-system-packages option bypasses Python's externally managed environment protection. This permits pip to modify the shared system Python environment rather than confining changes to a task-specific environment. Although the package names shown are established projects and the instruction does not explicitly select an untrusted package index, the installation remains exposed to compromised upstream releases, index or configuration manipulation, and unexpected dependency-resolution changes.

Attack Path

1. A user invokes the skill for a vocabulary-learning task that requires image generation.
2. The agent follows the documented image-generation sequence and runs the pip install command.
3. pip resolves the current mutable releases and their transitive dependencies using its configured package source.
4. If an upstream release, transitive dependency, configured index, or package-resolution path has been compromised, attacker-controlled package installation logic or imported code executes.
5. Because the command uses --break-system-packages, the installation can alter the shared Python environment and affect later Python-based operations.

Impact Assessment

Malicious package installation behavior could execute with the privileges of the agent process, allowing access to files, environment variables, and ne ...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --break-system-packages and install dependencies in a dedicated virtual environment or another isolated, disposable runtime.
2. Pin all direct and transitive dependencies to reviewed versions in a lock file.
3. Require cryptographic hashes during installation, such as with pip install --require-hashes -r requirements.txt.
4. Use an explicitly configured, trusted package repository or an internally mirrored and approved package source.
5. Prefer dependencies preinstalled in a vetted execution image so skill invocation does not require runtime package installation.
6. Periodically scan pinned packages for known vulnerabilities and update them through a controlled review process.
7. Run image generation with least privilege and restrict unnecessary filesystem and network access.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill declares that it "must" be triggered for broad, common educational scenarios such as word study plans, stories, quizzes, and review reminders, without meaningful scoping or conflict resolution. This can cause inappropriate routing, override better-matched tools, and increase the chance that unrelated user requests are forced through a file-generating workflow with unnecessary package installation and artifact creation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instructions require Chinese text in generated materials and mandate a specific Chinese system font for all Chinese text, but the skill does not state that this locale restriction is optional or region-specific. This can violate language/locale policy because the skill forces a specific language presentation without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.