Security audit

English Speaking Practice

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent English-practice skill with local learning records and optional scheduled message pushes, but users should review its API key, storage, and push settings before installing.

Install only if you want local practice history and optional scheduled English-learning pushes. Keep config.json private, use a limited API key, verify the API endpoint and target user ID, and do not add cron jobs for daily pushes or monthly summaries unless you want automated outbound messages.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares only TTS, Whisper, and message tools, but its instructions also require local shell execution and file read/write via Python scripts and temporary output paths. This creates hidden capabilities beyond the declared scope, reducing reviewability and allowing persistence or command execution behaviors that operators and users did not explicitly authorize.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 81% confidence
Finding: The documented behavior exceeds the stated purpose by adding data retention, scheduled outbound messaging to configured targets, and possibly broader content generation workflows not clearly disclosed in the skill description. Description-behavior mismatch is dangerous because reviewers may approve a narrowly scoped practice assistant while the actual skill performs additional autonomous actions and stores user-derived data.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs passing user-derived content into shell-accessible Python commands for persistence, even though it only briefly notes escaping parameters. User conversation text, vocabulary, and examples are attacker-controlled inputs; if escaping is incomplete anywhere in the real implementation, this can lead to command injection, data corruption, or unsafe storage of sensitive conversation content.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The scheduled push workflow sends messages to configured target users/channels autonomously, which goes beyond a purely user-initiated practice interaction model. Autonomous outbound messaging can be abused for spam, misdelivery, or sending content to unintended recipients if target configuration or authorization is weak.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide instructs users to place an API key in config.json and to enable scheduled pushes to external services, but it does not warn that the key is a sensitive secret or that user practice content and identifiers may be transmitted to third-party AI and messaging providers. This omission can lead to accidental credential exposure, improper file handling, and uninformed data sharing, especially if users store config files insecurely or enable push without understanding the privacy implications.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script sends user-derived learning summary data to an external API without any visible notice, consent flow, or disclosure. Even though the transmitted fields are aggregated counts rather than full conversation logs, this is still an outbound transfer of personal learning activity metadata to a third party, creating privacy and compliance risk.

Static analysis

No suspicious patterns detected.