Security audit

achievement-qztc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language document generator/reviewer for QZTC course achievement reports, and its file access is coherent with that purpose.

Install only if you intend to process QZTC-style course grade spreadsheets locally. Use it on copies or intended course folders, protect generated reports because they contain student data, review the output for accuracy, and be aware that one analysis paragraph currently hardcodes a course-specific 'data visualization' conclusion.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill describes and invokes local Python programs that read course spreadsheets and write generated DOCX files, but the manifest provides no explicit tool scope or permissions boundary. In an agent environment, undeclared file read/write capability increases the risk of over-broad filesystem access, accidental exposure of student data, or misuse beyond the intended working directory.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: 模块文档和清单描述表明该工具是通用的“课程目标达成情况分析表生成工具”，应基于输入课程生成对应分析内容。但这里无论课程名称为何，都会写入“数据可视化”的固定结论，主动表达了与实际课程无关的内容，属于文档/生成意图与代码行为的直接背离。

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This Python file contains docstrings and printed user messages exclusively in Chinese, which imposes a specific language on users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which is present here.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The phrase 'Tool Wrapper Pattern: 当遇到评分计算时加载此文档' is a broad natural-language trigger that can cause the agent to load and apply this reference whenever it merely detects a scoring-related task. Because the trigger is underspecified and embedded in untrusted content, it can lead to unintended activation, context injection, and incorrect tool/document selection in adjacent workflows such as review or generation pipelines.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This Python file contains natural-language instructions and descriptions that assume Chinese as the required language for all users. The policy for this audit flags forced language or locale usage when no opt-in, alternative language, or justification is provided.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The command-line help string is user-facing natural language and is only available in Chinese. Because the file provides no language-selection mechanism or stated locale limitation, this is a language policy violation under the audit criteria.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The skill processes spreadsheets containing student records and generates reviewable output documents, but the description does not clearly warn about handling potentially sensitive educational data. Missing privacy and data-handling warnings can lead operators to use the skill with real student information without understanding retention, exposure, or sharing risks.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The pipeline mode dynamically imports and executes an external local module (scripts.review_document) after modifying sys.path. In an agent/skill environment, this expands the trust boundary beyond the reviewed file and can execute unintended code if the local scripts directory or module contents are tampered with, making the skill more dangerous because users may expect only document generation, not arbitrary reviewer code execution.

Static analysis

No suspicious patterns detected.