Security audit

试卷OCR重建助手

Security checks for vulnerabilities and agentic risk

Overview

This exam OCR skill is mostly purpose-aligned, but its generated HTML reports have a real script-injection risk and it relies on mutable external code and services.

Review before installing. Use only with exam files you are allowed to send to OCR/LLM providers, avoid opening generated HTML from untrusted exam sources until the template is fixed, and prefer pinned dependencies plus local/bundled report assets where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/html-template-audit.html:214
Finding: Stored JavaScript Injection in Generated HTML Reports
Content: View full analysis
// Data populated by the report generator var EXAM_DATA = {exam_json}; var AUDIT_LOG = {audit_log}; ``` ```javascript (data.sections || []).forEach(function(section) { var sectionEl = document.createElement('div'); sectionEl.className = 'section'; sectionEl.setAttribute('data-section-type', section.section_type || ''); var html = ''; html += '
' + (section.section_title || '') + '
'; html += '
共' + (section.questions || []).length + '题，' + (section.section_score || '?') + '分
'; (section.questions || []).forEach(function(q) { var auditItem = getAuditItem(q.question_id); var auditClass = auditItem ? ' audit-' + auditItem.status : ''; var badgeHtml = auditItem ? '' + getStatusLabel(auditItem.status) + '' : ''; html += '
'; html += badgeHtml; html += '
' + q.question_id + '.' + (q.score || '?') + '分
'; if (q.material) { html += '
' + escapeHtml(q.material) + '
'; } html += '
' + renderLatex(escapeHtml(q.stem || '')) + '
'; if (q.options) { html += '
'; for (var opt in q.options) { html += '
' + ...[truncated 4313 chars]
Remediation: View remediation
SAFE_JSON ``` - Escape at least `<`, `>`, `&`, U+2028, and U+2029 during serialization. - Parse it using: ```javascript const EXAM_DATA = JSON.parse( document.getElementById('exam-data').textContent ); ``` 2. **Replace HTML string construction with safe DOM APIs.** - Create elements using `document.createElement`. - Assign untrusted text only through `textContent`. - Use `classList.add` and validated values for class names. - Avoid assigning OCR-derived strings to `innerHTML`. 3. **Strictly validate structured fields.** - Restrict `status` to `ok`, `corrected`, `warning`, or `error`. - Restrict `confidence` to `high`, `medium`, or `low`. - Restrict question and section types to the documented enumeration. - Require IDs and scores to be finite integers within expected ranges. 4. **Apply context-specific encoding.** - HTML text, HTML attributes, JavaScript strings, and URLs require different encoding strategies. - Do not rely on a single generic HTML-escaping function for all contexts. 5. **Add a restrictive Content Security Policy.** - Remove inline event handlers and inline scripts where feasible. - Use a nonce or hashed scripts. - Restrict `connect-src` to prevent unexpected data transmission. 6. **Add regression tests** using hostile values in every report field, including script-closing sequences, event-handler markup, quotes, malformed IDs, and malicious class values. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:67
Finding: Unpinned Python Dependencies Installed from an Alternate Package Index
Content: View full analysis
Remediation: View remediation
``` 2. Generate a lock file that includes all transitive dependencies. 3. Record cryptographic hashes for every permitted artifact and install with: ```bash pip install --require-hashes -r requirements.txt ``` 4. Prefer the organization's approved package index. If an alternate mirror is required, explicitly document its trust assumptions and synchronize only reviewed artifacts. 5. Separate optional PaddleOCR dependencies from the minimal PDF-conversion environment so users do not install a large dependency tree unless needed. 6. Install dependencies in an isolated virtual environment or container with minimal filesystem and network privileges. 7. Add routine dependency scanning and a controlled process for reviewing and updating pinned versions. ]]>

T08 · Insecure Dependencies

Warning

Location: references/html-template-audit.html:7
Finding: Remote KaTeX Scripts Loaded Without Subresource Integrity
Content: View full analysis
``` ### Technical Analysis Each generated or sample report retrieves executable JavaScript from a third-party CDN when the report is opened. The resources do not include Subresource Integrity metadata. The version is present in the URL, which reduces accidental version drift, but it does not cryptographically bind the report to reviewed artifact contents. The browser trusts whatever response is delivered by the CDN and TLS path at viewing time. The behavior also conflicts with the Skill's statement that the HTML report uses inline CSS and has no external dependencies. In practice, report rendering depends on external CSS and JavaScript. ### Attack Path 1. The Skill creates an HTML report containing the remote KaTeX script references. 2. A user opens the report while connected to the network. 3. The browser requests the scripts from the configured CDN. 4. The CDN account, hosted asset, DNS/TLS delivery path, or upstream publishing process is compromised. 5. A modified JavaScript resource is returned. 6. The browser executes that resource with access to the report DOM and embedded exam data. ### Impact Assessment A compromised remote script executes with the same browser privileges as the report's own JavaScript. It can: - Read questions, answers, explanations, and audit information from the document. - Alter the report's visible content and result ...[truncated 416 chars]
Remediation: View remediation
``` 3. Add integrity metadata to the stylesheet and both script resources. 4. Deploy a Content Security Policy that restricts: - `script-src` to approved, integrity-protected sources. - `style-src` to approved sources. - `connect-src` to `'none'` unless networking is explicitly required. 5. Update the Skill documentation to disclose the external runtime dependency, or remove that dependency to satisfy the documented self-contained-output guarantee. 6. Maintain a reviewed update process for bundled or integrity-pinned KaTeX releases. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly describes processing exam papers through external OCR and LLM services, but it does not warn users that potentially sensitive educational content may be transmitted to third parties. This creates a real privacy and compliance risk because users may unknowingly upload copyrighted exams, student data, or internal school materials to external providers.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to generate local output files such as HTML, JSON, and Markdown and references local scripts, but it does not declare an explicit tool scope or allowed-tools boundary. That creates a permission ambiguity where an agent may perform file writes more broadly than the user expects, increasing the risk of unintended overwrites or unsafe file creation on the host environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger set is broad and generic, including common OCR and exam-related phrases, which raises the chance that the skill activates in contexts where the user did not intend full OCR processing, external transmission, or file generation. Misactivation is especially risky here because the workflow may send sensitive exam content to external OCR services and create derived artifacts automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill processes potentially sensitive exam papers and explicitly routes images/text through external OCR connectors and LLM review, yet it does not warn users that their content may be transmitted to third-party services. This can expose confidential exam materials, answer keys, student data, or copyrighted content without informed consent, making the context more dangerous than ordinary OCR usage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML document explicitly sets lang="zh-CN", and the visible UI text throughout the template is exclusively in Chinese. This imposes a specific language/locale on all users without any opt-in, selection mechanism, or stated region-specific justification, matching the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document is written entirely in Chinese and the embedded system prompt explicitly instructs the model to act as a Chinese OCR review expert, with all required outputs and examples also in Chinese. There is no indication that the user can opt into another language or that the Chinese-only constraint is a documented region-specific requirement, which creates a language/locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide recommends cloud OCR workflows for exam pages without clearly warning that document images and their contents are sent to external services. Because exam papers may contain sensitive educational content or student data, this can cause unintended third-party disclosure and create privacy, compliance, or confidentiality issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Baidu OCR example includes concrete code for transmitting base64-encoded exam images to a third-party API but does not disclose that the content is uploaded off-device. This omission is risky because users may assume local processing, while sensitive exam materials or embedded personal data are actually being shared with an external provider.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language instructions and feature description are presented in Chinese only, with no indication that the user can choose another language. Per the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file is natural-language documentation, and it consistently forces a single language/locale for headings, descriptions, and template text. Under the policy, locale or language restrictions should either offer user choice or be explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file presents all instructions, examples, and classification rules exclusively in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in or a documented justification can be a locale policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON content forces a single language/locale through titles, instructions, questions, answers, and explanations, with no indication that users can choose another language. Under the policy, a fixed language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The page explicitly sets lang="zh-CN" and all visible UI text is in Chinese, with no indication that users can choose another language or that the locale restriction is intentionally limited to a region-specific use case. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This HTML/JavaScript file includes an export function that generates and downloads a JSON file with the exam contents, answers, explanations, and metadata. While the action is triggered by a button click, there is no visible warning, notice, or explanatory text informing users that clicking export will save potentially sensitive educational content to local storage.
Content: No source excerpt is available for this finding.