Ted English Learning

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:21 AM UTC
• Version: 0.1.0

Overview

The skill's TED study workflow is coherent, but installation and runtime depend on unreviewed mutable remote code and dependencies.

Review the referenced GitHub repository, extractor script, templates, and requirements before installing. Prefer a pinned commit or signed release, install in a virtual environment, and only run it on TED transcript PDFs or pasted text you intend to process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:23

Finding

Unpinned Remote Repository and Unverified Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 23-27
Vulnerability Type: Supply-chain exposure through mutable remote content and unverified Python dependencies
Risk Level: Medium

Vulnerable Code

bash

git clone https://github.com/xiao2769433/ted-english-learning.git ~/.claude/skills/ted-english-learning
cd ~/.claude/skills/ted-english-learning
pip install -r requirements.txt

Technical Analysis

The installation instructions clone the mutable default branch of a remotely hosted personal repository. They do not pin a reviewed commit, validate a release signature, or verify downloaded content against a cryptographic checksum.

The instructions subsequently direct pip to process requirements.txt. That dependency manifest is not included in the audited artifact, so its package sources, version constraints, hashes, and installation behavior could not be verified. Python package installation can execute package build or installation logic. Consequently, compromise of the repository, its account, or one of its dependencies could introduce code that runs during installation.

The audited file does not itself contain a malicious payload, and there is no evidence that the referenced repository or its dependencies are currently malicious. The risk arises from trusting mutable, unaudited remote content.

Attack Path

1. An attacker compromises the referenced repository, its maintainer account, or a dependency named by requirements.txt.
2. The attacker modifies repository content or supplies a malicious dependency release containing installation-time code.
3. A user follows the documented installation procedure without pinning or verifying the retrieved revision.
4. git clone retrieves the attacker-controlled content from the current default branch.
5. pip install -r requirements.txt resolves and installs the unverified dependencies.
6. Malicious build or installation logic executes ...[truncated 636 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to a specific, reviewed Git commit or immutable signed release rather than the repository's default branch.
2. Publish cryptographic checksums or signed release artifacts and verify them before installation.
3. Include the complete requirements.txt and all referenced scripts and templates in the reviewable skill package.
4. Pin every dependency to an exact version and require hashes, such as through a lock file or pip install --require-hashes.
5. Review direct and transitive dependencies for provenance, known vulnerabilities, typosquatting, dependency confusion, and unexpected build scripts.
6. Install dependencies inside a dedicated virtual environment or other sandbox using a non-privileged account.
7. Prefer pre-reviewed internal mirrors or trusted package indexes, and disable unintended alternate package sources.
8. Re-audit the referenced extractor, templates, dependency manifest, and transitive packages before treating the installation workflow as trusted.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description says it should be used whenever a user mentions TED talks, English learning, speech analysis, or TED transcript analysis, which is much broader than a narrowly scoped file-processing skill. Overbroad triggers can cause the agent to invoke this skill in unrelated or only loosely related conversations, increasing the chance of unintended file operations, tool execution, or confusing workflow takeover.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.