看剧看电影学英语超级助手 Learning English from TV Series (DramaLex)

• Outcome: Review
• Latest audit: Jul 18, 2026 · 3:02 PM UTC
• Version: 1.0.0

Overview

This is a real English-learning skill, but it needs Review because it directs broad subtitle retrieval, includes site-protection bypass language, and has under-scoped network behavior.

Install only if you are comfortable with an agent searching the public web for subtitle sources, downloading subtitle files, writing local study artifacts, and possibly using online TTS if selected. Prefer user-supplied lawful subtitles, avoid gated or protected sites, disable or avoid gTTS unless you accept sending text to a third party, and keep reminders off unless you explicitly want them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tainted flow: 'req' from os.environ.get (line 17, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def download(url, out_path):
    try:
        req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
        with urllib.request.urlopen(req, timeout=20) as r, open(out_path, 'wb') as f:
            f.write(r.read())
        return os.path.exists(out_path) and os.path.getsize(out_path) > 0
    except Exception as e:

• Confidence: 92% confidence
• Finding: The script sends a user-supplied or environment-supplied URL directly to urllib.request.urlopen with no allowlist, scheme restriction, or destination validation. This creates an SSRF-style primitive that can be abused to make the agent fetch arbitrary internal or local resources (for example localhost, cloud metadata endpoints, or file://-like targets depending on runtime support), which is especially risky in an agent environment with network reachability beyond the end user.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and orchestrates network, shell, file-write, and environment-backed operations without an explicit permissions declaration or narrowing controls. That mismatch increases the chance of overprivileged execution and makes it harder for a host agent or reviewer to understand the real attack surface before activation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The instructions explicitly tell the agent to locate 'real download direct links' and bypass intermediary pages and Cloudflare-style protections. This is dangerous because it normalizes defeating access controls and anti-bot measures, pushing the agent into behavior that can violate site protections, policy boundaries, and legal restrictions.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The skill claims it does not include a subtitle crawler, yet elsewhere directs broad internet discovery and direct-link retrieval. This inconsistency obscures the true behavior of the skill and can mislead users, reviewers, or policy enforcement systems about the extent of networked acquisition activity.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The file layout describes one script as only generating source links and not downloading, while surrounding sections describe retrieval and local write-out of subtitle content. Such contradictions weaken informed consent and reviewability, and may conceal copyrighted-content acquisition behind softer wording.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases are broad and overlap with ordinary user requests, which can cause the skill to activate in situations the user did not explicitly intend. In an agent ecosystem, over-broad activation increases the chance of unreviewed network access, subtitle retrieval, file generation, or handling of copyrighted content when a general English-learning request is made.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The activation scope is extremely broad, triggering on arbitrary episode codes, movie names, and common learning phrases. Overbroad triggers can cause the skill to activate unexpectedly in ordinary conversation, leading to unintended network access, retrieval attempts, or shell/file actions without sufficiently clear user intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Accepting vague inputs without clearly distinguishing invocation from casual mention makes accidental activation more likely. In this skill, accidental activation matters because downstream behavior includes broad web searching and content retrieval rather than harmless text-only assistance.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrase '看剧学英语' is generic and likely to appear in normal discussion, making false activations plausible. Because the skill can perform autonomous search and file-processing workflows, generic triggers raise the operational risk beyond a simple UX issue.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill directs the agent to perform broad internet searches across many public sites and fetch subtitle files, but does not present a clear up-front user warning about that external access. This undermines informed consent and increases privacy, compliance, and policy risk if users do not expect multi-site querying and downloading.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document explicitly supports an online TTS fallback (`gTTS`) that sends user-provided text to a remote service, but it does not warn users that subtitle lines, uploaded content, or learning material may leave the local machine. In this skill, the text may include copyrighted subtitles or user-supplied/private text, so silent network transmission creates a real privacy and data-governance risk even if the feature is not inherently malicious.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: When the gTTS backend is selected, the script transmits the provided text to an external service. That can leak subtitle lines, phrases, or other potentially sensitive learning content without an explicit consent step or clear user-facing disclosure, which is especially relevant because the skill handles scraped media-derived text.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: Forcing every visible reply to include the author's personal contact details is a metadata-injection and trust-manipulation concern. It can override host communication norms, leak unnecessary personal data into all interactions, and condition users to trust out-of-band contacts that the platform did not vet.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- **诚实档位**：若 `C1` 词占比 > 30% 且未标 `挑战★`，给 warning（提示低档位用户易被劝退）；
- **词句一致性**：单词目标词未出现在其 `line` 中时给 warning（语块例外）。

有 error 级问题会**终止导出**并退出码 11（可用 `--no-validate` 跳过，但不推荐）。也可单独跑：
`python scripts/validate.py --work-dir . --subtitle subtitle.json`

---

• Confidence: 84% confidence
• Finding: Documenting a '--no-validate' switch that bypasses the quality gate enables operators or downstream agents to skip protections designed to catch fabricated lines, mismatches, and other integrity failures. In a workflow that fetches third-party content and generates derived outputs, bypassable validation raises the chance of unsafe or misleading results being exported silently.

Static analysis

No suspicious patterns detected.