AI 伴学助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a genuine K-12 homework helper, but it handles children's images, audio, study records, and cloud sharing with insufficient consent, retention, and scoping controls.

Install only if you are comfortable sending homework images, screenshots, audio, and generated explanation text to Tencent Cloud, and only after a parent or guardian approves that use. Avoid including a child's real name, school, address, or other identifiers in submitted files or saved notebooks. Store generated Excel notebooks and reports in a private location, review reports before sharing them through enterprise messaging or Tencent Docs, and prefer pinned dependency versions rather than latest or lower-bound installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Allow Mutable Supply-Chain Code

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/requirements.txt:1
• README.md:33
• README.md:48
• references/wrong-question-notebook.md:58

Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

scripts/requirements.txt:1:

text

tencentcloud-sdk-python>=3.0.0

README.md:33:

bash

pip install -r scripts/requirements.txt

README.md:48:

bash

npx clawhub@latest install homework-companion

references/wrong-question-notebook.md:58:

bash

pip install openpyxl

Technical Analysis

The project installs executable third-party components without pinning them to exact, reviewed versions:

• tencentcloud-sdk-python>=3.0.0 permits any current or future release satisfying the lower bound.
• pip install openpyxl resolves whichever compatible release is current at installation time.
• npx clawhub@latest explicitly downloads and executes a mutable registry release.

Consequently, installations are not reproducible and the code executed by users can differ from the code available when this project was audited. No malicious dependency is present in the reviewed repository, but a future compromised, hijacked, or unexpectedly incompatible upstream release could become part of the effective execution chain without any change to this repository.

Hash verification is also absent, so package integrity is delegated entirely to the package registry and transport infrastructure.

Attack Path

1. An attacker compromises an upstream package, package-maintainer account, release pipeline, or distribution channel used by tencentcloud-sdk-python, openpyxl, or the clawhub CLI.
2. The attacker publishes a malicious release that satisfies the unconstrained requirement, or replaces the release selected by the latest tag.
3. A user follows the documented installation command.
4. pip or npx resolves and downloads the attacker-controlled release.
5. Package in ...[truncated 1214 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound and unconstrained requirements with exact versions that have been reviewed and tested:

   text

   tencentcloud-sdk-python==<reviewed-version>
   openpyxl==<reviewed-version>
   

2. Generate a lock file containing all transitive dependencies rather than pinning only direct dependencies.

3. Record and verify package hashes. For Python dependencies, use a fully hashed requirements file and install it with:

   bash

   python -m pip install --require-hashes -r scripts/requirements.lock
   

4. Add openpyxl to the project's reviewed dependency manifest instead of instructing users to install it separately.

5. Replace npx clawhub@latest with an exact, reviewed CLI version. Where supported, verify package provenance, signatures, and integrity before execution.

6. Install dependencies in a dedicated virtual environment with minimum filesystem permissions. Avoid exposing unrelated secrets during installation.

7. Use automated dependency monitoring, but require review and testing before updating pinned versions or hashes.

8. Document the dependency-update procedure so that version changes undergo security review rather than being selected automatically at installation time.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs use of Tencent Cloud OCR/ASR/TTS with child homework photos, screenshots, and audio, but does not prominently warn users that this content may be transmitted to third-party cloud services. In a K-12 setting, this is especially sensitive because submissions may contain minors' personal information, voices, handwriting, and school-related data.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The natural-language instructions and examples are entirely in Chinese, and the README frames the skill as operating in that language without mentioning any user language choice or an explicit region-specific limitation. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue unless clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README describes sending homework photos, voice recordings, and child-related learning content to Tencent Cloud OCR/ASR/TTS services, but does not provide a clear privacy warning, consent guidance, retention notice, or data-handling disclosure. Because the skill is explicitly for K12 children, this raises the severity: operators may transmit minors' personal data and educational content to a third party without informed consent or adequate safeguards.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README instructs users to run npx clawhub@latest install homework-companion, which fetches and executes the latest package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the upstream package is compromised or changes unexpectedly, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level manifest description presents a strict behavioral promise that the skill will never directly provide answers. However, the body of the skill documentation explicitly says that after the child completes the reasoning process, the skill may give a '标准解法总结', which is a direct solution/explanatory answer. This is a semantic mismatch in the declared behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad, everyday terms such as '帮孩子讲题' and '作业助手', which can cause the skill to activate in conversations not intended to invoke OCR/ASR/TTS or child-focused data handling. In this skill context, accidental activation is more concerning because it may lead to unnecessary processing of children's images, audio, and educational records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation first frames the skill as never directly giving answers, but the same guidance then allows a final standard solution once the child has worked through the problem. That is not merely incomplete wording; it conflicts with the stronger absolute phrasing used elsewhere in the skill's intent description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the system to accumulate wrong-question notebooks across sessions and generate parent reports, but does not clearly warn users that children's learning records may be persistently stored. This creates privacy risk because long-lived educational profiles can reveal weaknesses, habits, schedules, and other sensitive child-related information over time.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions explicitly create a retention and disclosure flow for children's submitted content by storing wrong answers across sessions and producing parent reports for onward sharing. In this context, the data-handling path is sensitive because it aggregates minors' educational content and may disclose it to additional recipients or connectors without clear minimization and consent safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs saving parent reports to local files and optionally pushing summaries through enterprise messaging or Tencent Docs, but it provides no consent flow, disclosure, retention limits, or safeguards for sharing a child’s educational data. In a K12 tutoring context, these reports may contain sensitive student performance, behavioral, and learning-profile information, so silent persistence or transmission increases privacy and unauthorized-disclosure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The title and policy content are written as mandatory rules for the assistant, and there is no indication that users may choose another language or locale. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy violation unless the constraint is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains all instructional content in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to Chinese-speaking contexts. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill specification is written as a normative template in Chinese, including required field names and user-facing guidance, but it does not indicate that Chinese is optional or limited to a China-specific context. Under the policy rule, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

ENGINE_TYPE_MAP maps both supported modes to 16k_zh and 8k_zh, which forces Chinese-language recognition. This is a natural-language locale constraint with no user opt-in, no alternative language selection, and no explicit justification that the skill is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script base64-encodes the entire user audio file and sends it to Tencent Cloud ASR, but provides no in-script notice, consent flow, or privacy warning that children's or parents' voice data leaves the local environment. In a K12 homework assistant context, this is more sensitive because the audio may contain minors' voices and educational content, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script base64-encodes the supplied image and sends it to Tencent Cloud OCR, but there is no consent flow, disclosure, or minimization despite the skill targeting K12 homework, which may include children's personal data and school information. In this context, silent third-party transmission is a real privacy/security issue because users may reasonably expect local processing unless clearly told otherwise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends user-provided text to Tencent Cloud TTS for synthesis, which is an external third-party data transfer. In a homework assistant context, that text can contain children's educational content and potentially personally identifiable or sensitive information, yet the code provides no explicit disclosure, consent check, or minimization before transmission. This creates a real privacy and compliance risk rather than a purely theoretical concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README advertises generation of a persistent Excel wrong-question notebook and parent reports but does not warn users that the skill may write study records to local storage. On a shared machine, these files can expose a child's educational history and potentially sensitive personal information to other local users or backups.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The template and instructions are entirely in Chinese and present the report structure as the default required output, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's natural-language documentation and CLI/help text are entirely in Chinese, which forces a specific language experience without any visible opt-in or alternative. This matches the policy concern for language or locale constraints that are not optional or explicitly justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency is specified with only a lower bound, which allows future versions of the Tencent Cloud SDK to be installed without review. This can introduce supply-chain risk through breaking changes, vulnerable releases, or malicious compromise of an upstream package version, especially because this skill depends on cloud credentials and OCR/ASR processing.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

tencentcloud-sdk-python>=3.0.0