Security audit

edu-homework-grader

Security checks for vulnerabilities and agentic risk

Overview

This skill runs local homework-grading scripts and has no evidence of network exfiltration, persistence, credential access, or destructive behavior, but its documentation overstates several features that are not actually present.

Install only if you want a simple local JSON-based homework grader. Do not rely on the advertised OCR, photo/PDF parsing, batch reports, or advanced error-analysis features unless you verify they are added later, and avoid putting unnecessary student personal information in homework or report files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The code clearly supports the core grading workflow: it iterates over homework items, routes objective item types (MC/FIB/TF) to deterministic grading, routes other items to subjective grading with an optional rubric, totals scores, and outputs per-student results. That aligns substantially with the declared purpose of automated homework grading. However, the declared description also promises common-error analysis and personalized improvement suggestions, which are not present in this code chunk. Additionally, the description mentions use with homework text/photos, while this code only accepts structured JSON files and shows no ingestion or OCR/photo-processing behavior. Therefore this chunk only partially matches the declared description and omits several declared user-facing capabilities, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents commands that read inputs and write graded outputs, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an avoidable least-privilege gap: an agent/runtime may grant broader filesystem capabilities than are actually needed, increasing the chance of unintended access to student submissions, answer keys, or other local files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README says the skill may ship reference tables such as ICD-10, drug aliases, LOINC mappings, and industry medians, which are unrelated to K-12 homework grading in Chinese, Math, English, Physics, and Chemistry. This indicates the documented behavior and bundled data scope are broader than the manifest's stated educational grading purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code returns feedback strings only in Chinese ("答案正确" and "参考答案: ...") for all users. This imposes a specific language on output without any visible opt-in, configuration, or justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The returned feedback strings are fixed in Chinese ("覆盖关键点..." and "全部关键点已覆盖") with no indication that the user can choose the language or that the skill is intentionally limited to a Chinese-speaking context. This creates a natural-language locale policy concern because the skill forces a specific language in user-facing output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file documents automated homework grading and generation of graded.json and rendered reports, which implies handling student data and writing derived outputs. The description does not include any user-facing warning about privacy-sensitive educational data or that files containing grading results will be created.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The JSON values for the student name, questions, and answers are entirely in Chinese, which indicates a fixed language/locale assumption. Under the policy rule, forcing a specific language without user opt-in or justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The file contains answer text and keypoints in Chinese (e.g. "叶绿素", "叶绿体", "二氧化碳") without any indication that the skill is intended for a Chinese-language or region-specific context. Under the policy, forcing a specific language without user choice or justification can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The rendered report strings are partially or fully fixed in Chinese, and the script provides no option for the user to choose language or locale. This can violate language/locale policy expectations because the skill imposes a specific language for output rather than offering an explicit opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code writes generated results to the path provided by --output, which can overwrite an existing file, but there is no confirmation prompt, logging, or explanatory comment/docstring warning the user about the file write. For code files, file writes should have some visible disclosure unless the action is clearly warned elsewhere.
Content: No source excerpt is available for this finding.