botlearn-certify

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:40 AM UTC
• Version: 1.0.5

Overview

The skill’s certificate-generation purpose is mostly coherent, but it can install another skill automatically and generate persistent certificate files from locally parsed assessment data with weak scoping and sanitization.

Review before installing. This skill is not clearly malicious, but it can run a fresh assessment, read prior assessment reports, save certificate files, and automatically install botlearn-assessment if missing. Prefer installing only after confirming the dependency source/version, and treat generated HTML certificates as untrusted if assessment reports could be modified by another package or user.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/check-assessment.sh:50
• Finding: Automatic Installation of an Unpinned External Skill Dependency<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check-assessment.sh:50-59`; related invocation guidance in `SKILL.md:38-40` **Vulnerability Type**: Supply-chain risk through automatic installation of a mutable dependency **Risk Level**: High ### Vulnerable Code ```bash # Check 3: clawhub CLI available? echo "❌ botlearn-assessment not found in local directories" if command -v clawhub &>/dev/null; then echo "📦 Attempting to install via clawhub..." if clawhub install botlearn-assessment; then echo "✅ botlearn-assessment installed successfully" exit 0 else echo "❌ clawhub install failed" exit 2 fi ``` The corresponding setup instruction is: ```markdown If this is your first time running this skill, execute `bash scripts/check-assessment.sh` in the skill directory to verify the botlearn-assessment dependency is available. ``` ### Technical Analysis The script is presented as a dependency availability check, but it changes the environment by automatically executing: ```bash clawhub install botlearn-assessment ``` The dependency is not pinned to a reviewed version, checksum, immutable package digest, or verified publisher identity. The script also does not request explicit user confirmation before installation. Consequently, the effective behavior of the project can change after this project itself has been audited. This creates a supply-chain trust boundary: the security of the certification Skill depends on whichever package the external registry resolves under `botlearn-assessment` at installation time. A compromised registry account, malicious replacement release, or unexpectedly changed dependency could introduce hostile Skill instructions or executable scripts. ### Attack Path 1. The user runs the documented first-time setup command. 2. `check-assessment.sh` fails to find a local `botlearn-assessment` installation. 3. The script detects the `clawhub` executable. 4. Without requesting confi ...[truncated 1105 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make `check-assessment.sh` strictly read-only. If the dependency is absent, return a nonzero status and display installation instructions without installing anything. 2. Require explicit, informed user approval before any package installation. 3. Pin the dependency to an exact reviewed version rather than resolving the latest package implicitly. 4. Where supported, verify an immutable package digest, signature, and expected publisher identity. 5. Record the expected dependency version in project metadata and reject incompatible or unreviewed versions. 6. Separate checking and installation into different scripts or commands so a verification operation cannot silently mutate the environment. 7. Run third-party Skills in a sandbox with only the filesystem and tool permissions required for assessment. 8. Review the installed dependency before invoking its instructions or scripts. A safer check should terminate without installation: ```bash echo "botlearn-assessment was not found." >&2 echo "Review and install the pinned dependency explicitly." >&2 exit 1 ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/parse-results.sh:44
• Finding: HTML Injection Through Unescaped Assessment Report Fields<![CDATA[ ## Vulnerability Details **File Location**: `scripts/parse-results.sh:44-62`; vulnerable output sinks in `assets/certificate-html-template.md:432-494` and generation instructions in `flows/flow3-certificate.md:54-73` **Vulnerability Type**: Stored HTML and SVG injection in generated certificate files **Risk Level**: Medium ### Vulnerable Code Assessment-controlled dimension names are extracted without validation or encoding: ```bash # Pattern 1: | D{N} | Name | Score | ... grep -P '^\|\s*D\d' "$RESULT_FILE" 2>/dev/null | while IFS='|' read -r _ dim_id dim_name rest; do dim_id=$(echo "$dim_id" | xargs) dim_name=$(echo "$dim_name" | xargs) # Extract first number that looks like a score (0-100) score=$(echo "$rest" | grep -oP '[\d.]+' | head -1 || echo "N/A") echo "dimension: $dim_id | $dim_name | score: $score" done # Pattern 2: | Dimension Name | Score | ... (without D{N} prefix) if ! grep -qP '^\|\s*D\d' "$RESULT_FILE" 2>/dev/null; then # Look for table rows with dimension-like names and scores grep -P '^\|.*\|\s*[\d.]+\s*\|' "$RESULT_FILE" 2>/dev/null | grep -ivP '(header|---|\bweight\b)' | head -10 | while IFS='|' read -r _ name score rest; do name=$(echo "$name" | xargs) score=$(echo "$score" | xargs) if [[ "$name" =~ [A-Za-z\u4e00-\u9fff] && "$score" =~ ^[0-9.]+$ ]]; then echo "dimension: $name | score: $score" fi done fi ``` The HTML template contains direct insertion points for generated fragments and metadata: ```html <div class="header"> <h1>{{CERT_TITLE}}</h1> <div class="subtitle">BotLearn Certification Authority</div> </div> <!-- Axis lines from center to each vertex --> {{AXIS_LINES}} <!-- Historical data polygon (if available, dashed) --> {{HIST_POLYGON}} <!-- Fresh data polygon --> <polygon points="{{RADAR_POINTS}}" fill="rgba(var(--badge-rgb), 0.15)" stroke="var(--badge)" stroke-width="1.5" stroke-linejoin="round"/> <!-- Data point dots --> {{RADAR_DOT ...[truncated 3603 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every field read from assessment reports as untrusted. 2. Apply contextual output encoding: - HTML-escape text-node values. - Attribute-escape attribute values. - Permit only finite numeric values for coordinates, scores, and CSS percentages. - Do not insert untrusted strings as complete HTML or SVG fragments. 3. Validate scores using a strict numeric parser and require the range `0` through `100`. 4. Restrict session and certificate identifiers to explicit patterns such as `[A-Za-z0-9_-]+`. 5. Either reject markup characters in dimension names or encode at least `&`, `<`, `>`, `"`, and `'`. 6. Generate rows and SVG elements through a trusted serializer or templating engine with automatic escaping rather than free-form string replacement. 7. Keep localization strings separate from report-controlled data and escape them before insertion. 8. Add a restrictive Content Security Policy to generated certificates, for example one that blocks scripts, frames, plugins, and network connections. 9. Add automated tests with payloads in every report-derived field, including: ```html <img src=x onerror=alert(1)> </text><script>alert(1)</script><text> "><foreignObject>...</foreignObject> ``` 10. Fail certificate generation when unresolved placeholders or structurally invalid fragments remain. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose describes a certification-producing skill whose main function is to analyze assessment history and generate certificates. The supplied code does not perform any certificate generation, formatting, or certification logic. Instead, it verifies the presence of a dependency (botlearn-assessment), checks filesystem locations for that skill and its results/index files, and may invoke an external package manager command to install the missing skill. That is a materially different primary behavior from the declared description. While dependency checks could be a supporting implementation detail, this chunk contains only that setup/install behavior and none of the declared certification functionality, so the description does not accurately represent the actual code behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose describes an end-user certification generator, but the supplied code is only a parsing utility for one Markdown assessment result file. It extracts fields and table data and outputs a JSON-like/plain structured summary. There is no certificate creation, no certification decision logic, no multi-assessment history comparison, and no trigger implementation. While parsing results could be a supporting component of a certification system, this code chunk by itself does not accurately represent the declared primary behavior, so this is a meaningful description-to-behavior mismatch.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README describes the workflow, but it does not clearly warn at the user-facing trigger/usage level that activation will autonomously invoke a fresh assessment and create certificate files. That omission undermines informed consent and increases the risk of users accidentally causing compute-heavy actions or file writes they did not expect.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger set is broad and includes common terms like 'certificate' and several generic non-English phrases, which can cause the skill to activate in situations where the user did not intend to run a certification workflow. In this skill, unintended activation is more concerning because the documented behavior includes autonomously launching an assessment and generating files, creating unnecessary actions and possible surprise execution.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Several trigger phrases are generic and likely to appear in normal user dialogue, increasing the chance of ambient or mistaken invocation. In this skill's context, that is more dangerous because invocation may cascade into dependency checks, reading prior results, and generating saved artifacts without a clearly deliberate request.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation rules are broad enough that ordinary conversation about certificates or graduation could unintentionally invoke the skill. Unintended activation is risky here because the workflow includes reading assessment history, invoking another skill, and writing output files, so accidental triggering could cause unnecessary data access or side effects.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to execute a shell script during first-time setup, which expands the trust boundary from document processing into arbitrary local command execution. Because skill content must be treated as adversarial, an embedded script invocation can be used to inspect the environment, modify files, or chain into further actions unrelated to certificate generation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The template instructs the system to automatically adapt all visible text to the user's detected native language, which implies language inference from user data without an explicit user choice. That creates a privacy and profiling risk because inferred nationality, ethnicity, or locale can be sensitive, and the behavior is mandated rather than optional.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The runtime localization note again requires adapting headings and labels to the user's native language without asking the user, reinforcing automatic profiling behavior. In a certification context, this can misclassify users, reveal inferred background traits, and produce outputs in a language the user did not request.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This flow directs the agent to automatically search local skill directories and parse prior assessment reports, which may contain personal performance history, without requiring explicit user consent or even notifying the user before access. In a certification context this is security-relevant because it expands access to locally stored user data across directories and could expose sensitive educational or profiling information beyond the current request.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The instruction forces responses into the user's native language, which is a language/locale policy choice made without explicit user opt-in. The file does not offer an alternative language selection or explain why this locale behavior is required.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This is another explicit language-forcing instruction that constrains output locale regardless of user preference. Under the policy, language/locale should be user-selectable or clearly justified when restricted.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The flow directs execution of `bash scripts/parse-results.sh {REPORT_PATH}`, which is a shell/subprocess operation. In this markdown file, there is no warning to the user that a shell command will be run, nor any disclosure about its effect on local files or environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The flow explicitly writes certificate artifacts to local disk under `results/` and, on write failure, may emit the full certificate to stdout. Certificates can contain agent/session identifiers, scores, specialties, growth history, and language-derived personal data, so persisting them without clear user disclosure or consent creates a privacy and data-retention risk. In this skill context, the issue is more concerning because certification output is user-facing and likely tied to identifiable assessment history rather than purely transient system data.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script performs an automatic `clawhub install botlearn-assessment` if the dependency is missing, which introduces side effects beyond simple certificate generation or dependency checking. Installing software via a CLI can fetch and execute untrusted package content or alter the user's environment without explicit consent, creating a supply-chain and unauthorized-change risk.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 88% confidence
• Finding: The trigger '认证' is extremely short and semantically broad, making accidental matches likely in ordinary Chinese-language conversations. Because this skill can initiate multi-step workflows and file output, even a short trigger increases the risk of unintended execution beyond harmless chat behavior.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 88% confidence
• Finding: The trigger '证书' is a common standalone term and may activate on casual mentions rather than deliberate requests. In this context that broadness matters because the skill is not purely informational; it can read prior assessment data and create files, so accidental invocation has real side effects.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill directs saving certificate files to a results directory without indicating that file writes will occur or confirming user intent. While low severity on its own, silent artifact creation can surprise users, overwrite expectations about workspace cleanliness, and become more problematic if combined with broad triggers or sensitive content in generated files.

Static analysis

No suspicious patterns detected.