Generate Private K-12 School Client Education Handout

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.0

Overview

The skill is for making school handouts, but it asks for broad shell and file-reading access that its instructions do not justify.

Review this skill before installing because it grants shell and local file-reading capabilities that are not needed for ordinary handout drafting. Install only if you are comfortable with those tools being available during use, and avoid running it against sensitive school, family, student, or business materials unless the tool permissions are narrowed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:7

Finding

Excessive Shell and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: Excessive tool permissions that violate least privilege
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill is intended to generate an educational handout using chat and image-generation capabilities. Its documented workflow does not require arbitrary shell-command execution or access to local files. Nevertheless, the configuration grants both Bash and Read.

Granting tools beyond the skill's legitimate operational requirements expands its attack surface. If attacker-controlled content, a malicious prompt, or untrusted source material influences the agent, the unnecessary tools could be invoked to execute commands or inspect files unrelated to handout generation. The repository does not document restrictions that constrain these tools to specific commands, paths, or read-only project resources.

Attack Path

1. A user or external document supplies attacker-controlled instructions while the skill is active.
2. Those instructions induce the agent to invoke the permitted Bash or Read tool under the pretext of gathering information or preparing the handout.
3. The agent reads unrelated local files or executes shell commands that are not necessary for the declared task.
4. Data accessible to the agent may be disclosed through generated output, while shell commands may alter resources available under the agent process's operating-system privileges.

This path depends on successful manipulation of the agent and the permissions provided by its execution environment; the reviewed files do not themselves contain a command that automatically performs these actions.

Impact Assessment

Successful exploitation could expose files readable by the agent process and permit command execution with the same operating-system privileges as that process. The scope may include project files, local configuration, environ ...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash and Read from allowed-tools because neither capability is required by the documented handout-generation workflow.
2. Permit only the capabilities needed for the task, such as the documented chat and image_generation APIs.
3. If local reading later becomes necessary, replace unrestricted access with a narrowly scoped read-only interface limited to explicitly approved project files.
4. If command execution becomes unavoidable, use an allowlist of fixed commands and arguments, prohibit shell interpolation, run commands in a sandbox, and deny access to credentials, network resources, and unrelated filesystem paths.
5. Add documentation explaining why each permitted tool is necessary and test that untrusted prompts cannot trigger access outside the skill's intended scope.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill's activation guidance is broad enough that an agent could invoke it for loosely related 'client education work' without clear guardrails on scope, audience, or required human review. While this is not directly exploitable code execution, overly permissive routing can cause inappropriate use, off-target content generation, or accidental handling of sensitive school communications without sufficient validation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.