快樂刷牙俠

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:54 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent child brushing timer that stores local progress records and offers optional reminders, with privacy and accidental-trigger points users should understand.

Install only if you are comfortable with local brushing history for a child being saved under ~/.bookshelf-plus/kids. Use a nickname if preferred, avoid broad automatic activation, and manually remove those JSON files if you want to clear history. Add scheduled reminders only after reviewing the printed cron lines or scheduler setup.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior does not cleanly match the declared purpose: it introduces persistent local storage and extra child-related reward tracking behaviors that are security- and privacy-relevant but not clearly surfaced in the top-level declaration. When a skill under-describes data storage or side effects, users and orchestrators cannot make informed trust decisions, which increases the chance of unintended data retention or execution of features they did not consent to.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The listed trigger keywords are very broad everyday phrases such as '牙齒' and '幾分鐘了', which can cause the skill to activate in unrelated conversations. In a child-focused skill, accidental invocation increases the chance of unsolicited prompts, tracking actions, or logging behavior without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly states that persistent records about children's brushing behavior, names, times, streaks, and rewards are stored under a user directory, but it provides no user-facing privacy notice, consent flow, retention policy, or deletion guidance. Because the data concerns young children and behavioral routines, undisclosed storage raises meaningful privacy and compliance risk even if the data remains local.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises executable shell/Python usage and persistent file access, but it does not declare any explicit tool scope or permissions boundary in the manifest. That makes the agent's effective capabilities ambiguous and can lead to over-privileged execution, especially because the documented workflow includes running scripts, reading/writing local files, and invoking external system functionality such as TTS.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include very common everyday expressions such as '刷牙' and '快去刷牙', which creates a realistic risk of accidental invocation during normal family conversation. In this skill's context, unintended activation can cause script execution, TTS output, and child data logging without deliberate user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly stores persistent child-related brushing records, stickers, streaks, and configuration under a local directory, but it does not present a clear privacy warning, consent flow, retention policy, or deletion mechanism. Because the data concerns a young child and creates behavioral history over time, undisclosed retention materially raises privacy risk even if the storage is only local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing help text are written only in Traditional Chinese, and the generated reminders are also hard-coded in that language. There is no indication of language selection, opt-in, or justification for restricting the skill to a single locale.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/brushing_cron.py (reported line 223)May include surrounding context.

python

py = sys.executable or "/usr/bin/python3"
    skill = os.path.dirname(SCRIPT_DIR)
    lines = [
        "請將以下內容加入 crontab（crontab -e）：",
        "",
        "# 🦷 快樂刷牙俠 — 早安刷牙提醒（每天 07:00）",
        f"0 7 * * * cd \"{skill}\" && \"{py}\" scripts/brushing_cron.py --check morning --tts",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/brushing_timer.py (reported line 177)May include surrounding context.

python

if not say_available():
        return
    try:
        subprocess.Popen(
            ["say", "-r", str(rate), text],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/brushing_timer.py (reported line 507)May include surrounding context.

python

stop.set()
    for t in threads:
        t.join(timeout=0.5)
    return finish(args, who, duration)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains natural-language documentation and command output entirely in Traditional Chinese, including usage text and status messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The document defines the character voice and output style entirely in Traditional Chinese and requires all encouragement to be delivered in that persona, but it does not indicate that users can opt into another language or locale. This can constitute a language policy issue because the skill appears to force one language rather than offering a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language instructions and messages entirely in Traditional Chinese, including the module docstring and runtime output. Under the policy rule for language/locale constraints, this is a violation because the skill does not offer users any language opt-in or alternative locale handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language descriptions and user-facing output exclusively in Traditional Chinese, including the module docstring and command help context. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and there is no indication of alternative language support or user choice here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest describes a children's brushing timer and check-in system, but does not mention spawning local system processes. While audio encouragement is adjacent to the user experience, implementing it by launching an OS subprocess is a broader capability than the stated purpose itself and introduces host-level execution behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.