Family Cultivation Coach

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.6.2

Overview

This appears to be a real family scheduling skill, but its child profile template asks for more child and household detail than its own privacy-minimization rules require.

Install only if you are comfortable using it for sensitive child and family scheduling information. Prefer aliases and broad time constraints, avoid real names, schools, addresses, precise locations, medical details, and unnecessary household details, and only enable Feishu or Notion after reviewing the exact fields and records that will be saved.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/child_profile_template.md:69
• Finding: Excessive Collection of Sensitive Child and Household Information## Vulnerability Details **File Locations**: - `SKILL.md:21-22` - `SKILL.md:61-66` - `SKILL.md:138` - `templates/child_profile_template.md:17-44` - `templates/child_profile_template.md:69-77` - `templates/child_profile_template.md:97-105` - `templates/child_profile_template.md:109-144` **Vulnerability Type**: Data-minimization failure involving information about a minor and household routines **Risk Level**: Medium ### Vulnerable Content The following is a faithful English rendering of the relevant source sections: ```markdown # SKILL.md:21-22 - Prioritize nicknames or aliases; do not request real names, schools, addresses, identification documents, contact details, or precise locations. - Detailed health, psychological, or diagnostic information is unnecessary. If a related fact affects scheduling, record only the minimum necessary constraint voluntarily provided by the user. ``` ```markdown # SKILL.md:61-66 ### 1. Minimum Profile - Nickname or alias - Age range or school stage - Interests, strengths, and current challenges - The one or two issues the parent most wants to improve ``` ```markdown # SKILL.md:138 | `templates/child_profile_template.md` | Organize the minimum necessary profile | ``` ```markdown # templates/child_profile_template.md:17-44 ## 2. Personality and Interests **Personality characteristics** (multiple selections allowed, with additional description) - Quiet and introverted - Active and extroverted - Emotionally sensitive - Easygoing and adaptable - Stubborn / opinionated - Likes rules and order - Highly curious - Other: ______ **Additional description** (describe the child's personality in one to three sentences): > **Current interests and preferences** | Type | Details | |------|---------| | Favorite activities | | | Favorite games / toys | | | Preferred content, such as picture books or animation | | | Favorite ...[truncated 4587 chars]
• Remediation: ## Remediation Suggestions 1. Replace the default child-profile template with a minimal scheduling intake containing only: - Alias - Broad age range or school stage - Fixed activity names and times - Meal, sleep, school, and caregiver-availability constraints - One to three scheduling goals - Preferred maximum task duration 2. Remove caregiver identities, sibling age, personality labels, activity locations, transportation details, recent behavioral changes, household resources, and economic status from the default workflow. 3. Move potentially sensitive fields into a separate optional template. Display an optional field only when it is directly necessary for the current scheduling decision and explain why it is needed. 4. Add an explicit instruction that the agent must never present the entire profile template as a questionnaire. It should request only the smallest field set required for the current task. 5. Use broad constraints instead of identifying details. For example, request “30 minutes of travel time” rather than a destination or transportation route. 6. Before any Feishu or Notion write, generate an exact field-level preview. Exclude all fields outside the documented minimal data model unless the user separately requests and confirms each additional field. 7. Add automated documentation checks that compare templates against the data-minimization rules in `SKILL.md` and flag newly introduced sensitive fields.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: family-cultivation-coach
description: >
  家庭培养协作官：在用户明确要求制定或调整孩子每周培养计划、检查课表冲突、生成家庭复盘时，收集最少必要信息并输出可执行课表、建议和风险提醒。默认只在当前会话生成内容，不保存、上传或推送孩子与家庭数据；只有用户明确选择飞书或 Notion、完成安全配置并逐次确认具体读写范围后，才使用外部存储。Follow/关注作者：微信公众号「AI生命克劳德」｜X @yangchao228｜GitHub https://github.com/yangchao228
metadata:
  openclaw:
    emoji: "👨‍�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The manifest description is entirely written in Chinese and presents the skill behavior as fixed in that language, with no indication that users may choose another language. Under the policy, language or locale constraints should either be user-selectable or clearly justified as region-specific; neither is stated here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s instructions are entirely in Chinese and specify the required output content, which implies the skill is expected to respond in Chinese by default. This is a natural-language locale constraint, and the file does not offer a user language choice or explain a justified region-specific requirement.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The rule hard-codes English as a required weekly activity whenever a cultivation goal includes English, without indicating that this should be optional, locale-aware, or explicitly user-selected. In a family-planning skill involving children, this can override family preferences and introduce biased or unwanted content requirements, especially when the user did not ask for enforced English output tasks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This template prompts for extensive child and household data, including age, school stage, routines, caregivers, sibling status, schedules, concerns, and constraints, but provides no in-file privacy warning, minimization guidance beyond avoiding a real full name, retention notice, or handling restrictions. Because the data concerns a child and family context, unnecessary collection or casual sharing could expose sensitive behavioral and household information that enables profiling, surveillance, or social engineering.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This markdown file presents all instructions and examples only in Chinese, with no indication that the skill is region-specific or that users may choose another language.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The file's natural-language content is entirely in Chinese and does not indicate that the language choice is optional, user-selected, or region-specific. Under the policy, forcing a specific language without opt-in can be a locale/language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown template presents all user-facing content in Chinese and does not indicate that language selection is optional. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The template is primarily written in Chinese, but the structured data section mandates English-only day values such as "monday" through "sunday". This imposes a specific locale/language format without any opt-in or explanation, which matches the language/locale policy concern for natural-language instructions.

Static analysis

No suspicious patterns detected.