Security audit

math-guide-solver

Security checks for vulnerabilities and agentic risk

Overview

This math skill is placed in Review because it includes user-facing GitHub release automation that can modify and publish a repository, which is outside normal math-solving use.

Review carefully before installing. The math functions appear purpose-aligned, but do not run GITHUB_UPDATE_SCRIPT.sh unless you intentionally want it to alter and push a Git repository using your local credentials. Avoid uploading sensitive homework, student records, or personal notes unless you are comfortable with the skill's OCR/model integrations and unclear third-party data-handling details.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This script performs local file copying, Git commits, tag creation, and remote pushes to GitHub, which are materially unrelated to the advertised math-solving/OCR functionality of the skill. In a skill package, repository publishing automation expands the trust boundary from math processing into source-control operations and could be abused to modify and publish repository state if executed by a user or agent with Git credentials.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file contains unjustified source-control and remote publishing actions such as git add, git commit, git tag, and git push origin, enabling modification and publication of repository contents. In the context of a math-solver skill, these capabilities are over-privileged and dangerous because they can exfiltrate changes to a remote repository or create unauthorized releases when run in an environment with repository access.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The guide instructs the user to execute `bash GITHUB_UPDATE_SCRIPT.sh` even though the file provides no script contents, provenance verification, or explanation of what the script changes. In a math-solving skill, asking users to run an opaque shell script is unnecessary and creates a clear path to arbitrary code execution, filesystem modification, credential exposure, or persistence if the script is malicious or later replaced.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The guide asks the user to search for and disclose local filesystem paths such as the location of the `math-solver` directory. While not inherently code execution, this solicits environmental information unrelated to solving math problems and can expose sensitive details about the user's system layout, usernames, or storage locations that could be leveraged in follow-on social engineering or targeted commands.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The guide tells the user to run a shell script with no warning, no dry-run behavior, no summary of effects, and no review step. That is dangerous because users are being prompted to execute opaque system-level commands from a skill package whose stated purpose is math processing, making accidental execution of harmful operations far more likely.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README states that dependencies include PaddleOCR and Claude API, and describes automatic image processing and solution generation, but it does not clearly warn users that uploaded images and extracted problem content may be transmitted to external services. This creates a privacy and consent issue, especially because math problem images may contain handwritten notes, student information, or other sensitive content.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill states that it integrates with PaddleOCR, Claude API, and optional Mathpix/Wolfram Alpha, but it does not clearly warn users that uploaded images, extracted formulas, and problem content may be transmitted to third-party or external services. This creates a privacy and data-handling risk, especially if users upload homework, personal notes, or sensitive documents containing identifying information.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation advertises optional integration with third-party services such as Wolfram Alpha, Mathpix, and Symbolab without warning that user-supplied images or extracted mathematical content may be transmitted off-platform. In a skill that processes uploaded homework photos and embedded content, this creates a real privacy and data-handling risk because sensitive educational data or metadata could be shared unexpectedly with external providers.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes broad, common phrases such as 'solve this' and 'homework help' that can match ordinary user requests outside the intended math-solving scope. Overly generic triggers increase the chance of accidental invocation, misrouting user tasks to this skill, and unnecessary access to image/OCR and model-processing capabilities.

Static analysis

No suspicious patterns detected.