前程似锦-高考升学规划Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.1.0

Overview

The skill is not overtly malicious, but it needs review because it can inspect the agent environment and includes under-scoped memory-reuse guidance beyond ordinary admissions advice.

Review this skill before installing if your agent has access to persistent memory or a private list of installed Skills. The main risks are broad compatibility inspection and unscoped reuse of prior memory; install only if you are comfortable with those behaviors or can restrict them through the host platform.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: calibration/index.js:90
• Finding: Unnecessary Enumeration of Installed Skills<![CDATA[ ## Vulnerability Details **File Location**: `calibration/index.js:90-101` **Vulnerability Type**: Least-privilege violation through environment reconnaissance **Risk Level**: Medium ### Complete Code Snippet ```js const installedSkills = await env.getInstalledSkills(); if (installedSkills && installedSkills.length > 0) { const conflicts = await env.checkSkillConflicts(installedSkills, 'gaokao-advisor'); if (conflicts.length === 0) { results.passed.push({ check: 'Skill compatibility', detail: `No conflicts with ${installedSkills.length} installed Skills` }); } else { conflicts.forEach(c => { results.warnings.push({ check: `Conflict: ${c.skill}`, detail: c.description, autoFixed: c.autoFixed || false }); }); } } ``` The English labels above represent the corresponding original localized report strings; the executable calls and control flow are unchanged. ### Technical Analysis Standard calibration obtains the complete list of installed Skills through `env.getInstalledSkills()` and passes that inventory to `env.checkSkillConflicts()`. The package's primary purpose is university admissions advising, which does not inherently require visibility into all other installed capabilities. The access is disclosed in `SKILL.md`, but disclosure does not make the operation necessary or least-privileged. The code does not constrain the inventory to relevant interfaces, request a boolean-only compatibility result, or sanitize conflict details before adding them to a report. Exploitation depends on the privileges and behavior of the host-provided `env` object. The package does not itself transmit the inventory over the network or modify installed Skills. ### Attack Path 1. An operator or automated installation process invokes standard or deep calibration. 2. Standard calibration calls `env.getInstalledSkills()`. 3. The host returns the Agent's installed-Skill inventory. 4. The complete inventory is supp ...[truncated 847 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove installed-Skill enumeration unless a concrete compatibility requirement exists. 2. Replace full inventory retrieval with a host API that returns only a boolean compatibility result. 3. If individual checks are unavoidable, use a fixed allowlist of explicitly relevant interfaces rather than enumerating every installed Skill. 4. Require explicit operator consent before environment-wide compatibility inspection. 5. Do not include Skill names or untrusted host-generated conflict descriptions in user-facing reports. 6. Define and enforce a minimal permission declaration for calibration operations. 7. Treat all conflict descriptions as untrusted data and sanitize them before rendering. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: calibration/principles.md:27
• Finding: Unscoped Agent Memory Retrieval Directive<![CDATA[ ## Vulnerability Details **File Location**: `calibration/principles.md:27` **Vulnerability Type**: Unnecessary access to cross-session Agent memory **Risk Level**: Medium ### Complete Code Snippet ```md - `memory_get` before `API calls`: first consult conclusions already stored locally. ``` This is an English translation of the original instruction while preserving its directive and referenced tool name. ### Technical Analysis The Skill instructs the Agent to invoke `memory_get` before making API calls, but it does not define a Skill-specific namespace, user boundary, retention boundary, consent requirement, or filtering policy. A broad memory query may retrieve information from unrelated conversations or tasks. Because the retrieved material can subsequently influence admissions recommendations, unrelated or stale content may be incorporated into the current response. The directive does not write to persistent memory and therefore is not memory poisoning. It is an access-scope issue: the Skill encourages reading potentially broader Agent state than its legitimate task requires. ### Attack Path 1. The Skill is loaded and its calibration principles are applied. 2. Before an API request, the Agent follows the instruction to call `memory_get`. 3. In the absence of a required namespace or user/task filter, the retrieval query may match unrelated stored content. 4. Retrieved content is reused as an existing conclusion. 5. Sensitive, stale, or attacker-influenced information from another context may affect or appear in the current admissions advice. This path requires the host Agent to expose `memory_get` and permit retrieval outside the current task context. ### Impact Assessment Potentially exposed information includes prior-session conclusions, user preferences, or other content available through the host's memory service. The exact scope is determined by the host's memory isolation and authorization controls. The finding does not demonstr ...[truncated 236 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict retrieval to a dedicated namespace owned by this Skill. 2. Scope every query to the current user and current advisory task. 3. Require explicit user consent before using information from prior sessions. 4. Retrieve only the minimum fields required for the current request. 5. Prohibit retrieval of unrelated conversations, credentials, private identifiers, and other Skills' state. 6. Validate the provenance and freshness of retrieved conclusions before using them. 7. Prefer current-session context by default and make cross-session memory retrieval opt-in. 8. Document the memory retention, deletion, and isolation policies enforced by the host. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: calibration/index.js:140
• Finding: Calibration Reports Success Despite Failed Checks<![CDATA[ ## Vulnerability Details **File Locations**: - `calibration/index.js:140` - `calibration/index.js:218` **Vulnerability Type**: Fail-open validation and misleading success status **Risk Level**: Low ### Complete Code Snippets Standard calibration: ```js return { level: 'standard', duration: Date.now() - startTime, passed: results.passed.length, warnings: results.warnings.length, failed: results.failed.length, results, ok: results.failed.length <= 1 }; ``` Deep calibration: ```js return { level: 'deep', duration: Date.now() - startTime, passed: results.passed.length, warnings: results.warnings.length, failed: results.failed.length, results, optimizations, ok: results.failed.length <= 2 }; ``` The resulting status is used when selecting the report indicator: ```js const emoji = result.ok ? '✅' : '⚠️'; ``` ### Technical Analysis Standard calibration is considered successful when one check has failed, while deep calibration is considered successful when as many as two checks have failed. The failed checks can include API availability, model response testing, warm-mode validation, boundary tests, full test cases, or performance benchmarking. The implementation does not distinguish mandatory failures from optional failures. Consequently, a material validation failure can coexist with `ok: true`. The report generator then displays a success indicator based on that value, creating a false assurance that calibration passed. This is a fail-open validation weakness rather than direct arbitrary-code execution. An attacker who can influence a host-provided calibration response may deliberately cause a limited number of checks to fail while preserving an overall successful status. ### Attack Path 1. Standard or deep calibration is invoked. 2. A host service, unavailable dependency, malformed test result, or attacker-controlled environment causes one standard check or up to two deep checks to fail. 3. The failure count rem ...[truncated 778 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Mark calibration successful only when all mandatory checks pass: ```js ok: results.failed.length === 0 ``` 2. Classify checks explicitly as mandatory or optional. 3. Record optional issues as warnings rather than failures. 4. Return a structured status such as `passed`, `degraded`, or `failed` instead of a permissive boolean. 5. Ensure any API, model, boundary, data-integrity, or pricing failure produces a non-success report unless explicitly documented as optional. 6. Generate the visual report indicator from the structured severity, not only from `result.ok`. 7. Add tests confirming that every mandatory failure causes calibration to fail. 8. Prevent downstream operation when a mandatory calibration check has not passed. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill presents itself as a college-admissions planning assistant, but the document also describes environment checks, installed-skill enumeration, compatibility testing, conflict detection, and performance/QA-style calibration behavior. This mismatch can mislead users and reviewers about the scope of system access and cause them to authorize broader operational behavior than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill presents itself as a college-admissions planning assistant, but the document also describes environment checks, installed-skill enumeration, compatibility testing, conflict detection, and performance/QA-style calibration behavior. This mismatch can mislead users and reviewers about the scope of system access and cause them to authorize broader operational behavior than expected.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file states '温情模式默认' and describes it as providing emotional value by default. This imposes a specific communication style on users without explicitly offering prior choice or opt-in, which is a natural-language policy concern under language/locale/style constraints.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The configuration value '"warmMode": "default"' indicates the skill defaults to a predefined output style instead of waiting for user preference. Because the policy category covers natural-language constraints across all file types, this is a documented style enforcement issue unless users are clearly offered an opt-in choice first.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file contains operational instructions solely in Chinese, and nowhere indicates that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale/language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: Lines L68-L80 define mandatory time windows such as 06:00-12:00 and 22:00-06:00 as universal operating rules, but the file does not state a timezone, region, or user choice. This creates a locale/regional policy issue because the schedule is forced rather than presented as an opt-in or region-specific configuration.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s natural-language descriptions and report strings are entirely hard-coded in Chinese, indicating the skill is designed to operate in a specific language/locale by default. There is no visible user choice, opt-in mechanism, or documented justification that this calibration module is intentionally restricted to a Chinese-only regional deployment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The calibration logic enumerates installed skills and checks them for conflicts, which expands the skill's visibility into unrelated user environment data beyond what is necessary for gaokao planning. Even if intended for compatibility, this creates an avoidable privacy and reconnaissance surface: a compromised or over-privileged skill could learn what other skills are installed and use that information for profiling or targeted interference.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire skill guidance is written as a normative principles document in Chinese and does not indicate that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue unless the locale restriction is explicitly justified.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a gaokao admissions-planning expert using calibration and warm-mode guidance, but this file primarily implements a commercial pricing and promoter profit model. Functions expose hidden bulk tiers, compute reseller profit margins, and validate arbitrage conditions, which are business monetization operations rather than admissions-planning behavior.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This JavaScript file uses Chinese exclusively in its header, comments, labels, error messages, warnings, and summary text, with no indication that users can opt into another language. The policy for this category flags language or locale constraints when a skill forces a specific language without user choice or documented justification.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: `getProfitAnalysis` and `verifyPricingModel` calculate reseller margins, total profit, and whether the fission pricing model is commercially self-consistent. That capability is unrelated to delivering gaokao planning advice and instead supports distribution-channel or sales operations.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file contains user-facing natural-language instructions exclusively in Chinese, and it does not mention that the skill is intended only for Chinese-speaking users or offer any language/locale selection. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.