Security audit

NCCU OJ

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for solving and submitting NCCUOJ problems, but it handles real account credentials and session cookies in under-protected ways that users should review before installing.

Review this skill carefully before installing. It appears intended for legitimate NCCUOJ problem solving, but do not provide a valuable or reused password through the documented command examples, avoid running it in shared or logged environments, check that NCCUOJ_BASE_URL is unset or points only to the real NCCUOJ site, and remove .nccuoj/cookies.txt after use if you proceed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/session.py:15
Finding: Unrestricted API origin override can redirect credentials, session cookies, and source code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/submit.py:40
Finding: Passwords are accepted and documented as command-line arguments
Content: View full analysis
--username --password python $SCRIPTS/submit.py "C++" .nccuoj/solution/public//solution.cpp --username --password python $SCRIPTS/check_result.py --username --password --poll ``` ### Technical Analysis Command-line arguments are not an appropriate channel for passwords. Depending on the operating system and execution environment, arguments may be exposed through: - Shell history. - Process inspection interfaces and process-listing tools. - Agent tool-call transcripts and execution logs. - CI/CD logs, telemetry, or audit records. - Error reports that preserve the original command. - Terminal scrollback or copied command examples. Authentication is required for private problems, contests, submissions, and result access. However, requiring the password to appear in the p ...[truncated 1252 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/session.py:20
Finding: Authentication cookies are persistently stored without enforced restrictive permissions or cleanup
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool restrictions even though it instructs use of network access, file reads, and environment-adjacent execution behavior through helper scripts. Without declared scope, an agent may apply broader capabilities than necessary, increasing the blast radius if the skill or referenced scripts are modified or abused.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs users to pass NCCUOJ usernames and passwords directly as command-line arguments. CLI arguments are commonly exposed through shell history, process listings, logs, and telemetry, so this unnecessarily risks credential disclosure to other local users or monitoring systems.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The submission and result-check workflow repeats the insecure pattern of embedding plaintext credentials in command invocations. This expands exposure because the highest-value operations in the skill—submission and account-authenticated status checks—would routinely place credentials where they can be captured by logs or process inspection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill not only suggests passing credentials on the command line but does so without any warning about visibility in shell history, audit logs, or process tables. In this skill's context, users are likely to follow canned commands verbatim, making silent credential exposure more probable.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The contest workflow also requires plaintext credentials in command arguments, creating the same disclosure risk in a context where compromise may additionally affect active contest participation. Repeated insecure guidance normalizes unsafe handling of passwords and increases the chance of accidental leakage across shared machines or recorded terminal sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script accepts the account password via a command-line argument, which can expose credentials through shell history, process listings, job control logs, and CI/runtime telemetry. Because this skill is specifically for logging into an online judge and handling real user accounts, the issue is more dangerous in context: users are likely to supply actual NCCUOJ credentials that could be recovered by other local users or monitoring tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code accepts credentials from command-line arguments and immediately sends them in an HTTP login request, which is a safety-relevant network operation involving sensitive data. While the module docstring shows how to supply credentials, it does not warn that the password will be transmitted to a remote service or exposed via command-line usage patterns.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script persists authenticated session cookies to a predictable file under the current working directory and reloads them on later runs, but provides no disclosure, consent flow, or permission hardening. If the workspace is shared, backed up, or has weak filesystem permissions, another local user or process could reuse those cookies to access the NCCUOJ account without credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script requires the password to be passed as a command-line argument, which commonly exposes credentials through shell history, process listings, job-control logs, and CI/CD command output. Even if the login request itself is expected behavior for this skill, the lack of any safer input method or warning makes accidental credential disclosure likely.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.