Quick Learn

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 2.5.0

Overview

This skill is a coherent learning coach, but it stores learning progress locally and can create scheduled reminders.

Before installing, be aware that this skill can save learning plans, article or book breakdowns, daily logs, review state, and mood/progress notes under learning-data, and it may set up recurring learning or review pushes. Confirm any schedule before enabling it and avoid storing sensitive study material unless local retention is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill performs file read/write operations over persistent learning-data but does not declare any tool scope, permissions, or user-visible limits. This creates a transparency and least-privilege problem: users and the platform cannot easily tell that the skill can retain data or modify local state, which increases the chance of unintended persistence and misuse.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Mode A trigger phrases are broad enough to match ordinary conversational requests like 'help me learn X' or 'quick start X', which can cause the skill to activate unexpectedly. Because activation leads to source searches, file creation, and potentially cron setup, accidental triggering can produce unwanted persistence and automation on behalf of the user.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The Mode B phrases such as 'explain this article' or 'read this book' are common requests that may be made in many contexts, so the skill may capture routine prompts unintentionally. In this skill, unintended activation is riskier because it writes breakdowns to persistent storage and can initiate follow-up workflows based on user content.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill stores learning plans, sources, logs, and user explanations under learning-data, but the description does not warn users that their free-form learning history and content may be retained. This is dangerous because users may share sensitive professional, academic, or personal material while assuming the interaction is ephemeral.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill defines cron-based scheduled pushes and automatic follow-up behavior, but the description does not clearly warn users that it may create recurring jobs and send proactive content. Hidden or insufficiently disclosed automation can surprise users, cause repeated unwanted messages, and continue acting on stored state after the initial interaction.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The daily log persists free-form 'Feynman Restate', weak points, mood, and study metadata in plain language, which can easily contain sensitive personal, educational, or workplace information. Retaining this data over time increases privacy risk, especially if logs are later read, reused, or exposed beyond the user's expectations.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage

Content

| Type | Prompt (use user's language, keep tech terms in English) |
|---|---|
| **Technical / 技术** | EN: "In plain words, no code — what is it and what problem does it solve?" / ZH: "不用代码，用大白话告诉我它是什么、解决什么问题。" |
| **Process / 流程** | EN: "If you had to explain this process to a layperson, how would you do it?" / ZH: "如果让你把这个流程讲给一个外行听，你会怎么说？" |
| **Theory / 理论** | EN: "How does this theory differ from what you initially thought?" / ZH: "这个理论和你最开始的想法有什么不同？" |
| **System / 系统** | EN: "If you were to compare it to a real-life system, what would it be like?" / ZH: "如果用一个生活中的系统来类比，它像什么？" |
| **Business / 业务** | EN: "If you had 30 seconds in an elevator to explain it to your boss, what would you say?" / ZH: "如果要在电梯里用 30 秒给老板讲清楚，你会怎么说？" |

• Confidence: 70% confidence
• Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage

Content

| Type | Prompt (use user's language, keep tech terms in English) |
|---|---|
| **Technical / 技术** | EN: "In plain words, no code — what is it and what problem does it solve?" / ZH: "不用代码，用大白话告诉我它是什么、解决什么问题。" |
| **Process / 流程** | EN: "If you had to explain this process to a layperson, how would you do it?" / ZH: "如果让你把这个流程讲给一个外行听，你会怎么说？" |
| **Theory / 理论** | EN: "How does this theory differ from what you initially thought?" / ZH: "这个理论和你最开始的想法有什么不同？" |
| **System / 系统** | EN: "If you were to compare it to a real-life system, what would it be like?" / ZH: "如果用一个生活中的系统来类比，它像什么？" |
| **Business / 业务** | EN: "If you had 30 seconds in an elevator to explain it to your boss, what would you say?" / ZH: "如果要在电梯里用 30 秒给老板讲清楚，你会怎么说？" |

• Confidence: 70% confidence
• Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Line L03 states that search queries use English for technical topics, which imposes a language choice as a default rule rather than offering the user a language or locale preference. This matches the policy category for natural-language language/locale constraints without explicit opt-in.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation example includes "give me weekly report," which is a natural, generic request rather than a narrowly scoped trigger. Without clearer activation constraints or exclusion conditions, this could cause unintended invocation in ordinary conversation about reports.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The script uses a heuristic to choose Chinese or English automatically when `--lang` is left at `auto`, based on whether the topic contains Chinese characters. This imposes a language choice without explicit user selection, which matches the locale/language policy concern for natural-language behavior.

Static analysis

No suspicious patterns detected.