Chaoxing Auto Grade

• Outcome: Review
• Latest audit: Jul 4, 2026 · 2:45 PM UTC
• Version: 2.0.1

Overview

This skill appears purpose-built for Chaoxing grading, but it handles teacher login access, student work, external AI uploads, and in-place score edits without enough safeguards or privacy warnings.

Review before installing. Use a dedicated browser profile, avoid storing real passwords in config.json, confirm whether student submissions may be sent to the configured AI provider, restrict output directories, keep backups before running score write-back, and manually audit AI-generated grades before relying on them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly performs network access, reads local files, and writes or modifies HTML outputs, yet the manifest does not declare any permissions or capability boundaries. This creates a transparency and governance gap: a user or host system cannot accurately assess the skill's access needs before use, increasing the risk of over-trusting a workflow that handles credentials, student data, and file modification.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger list includes broad terms such as '超星', '学习通', '自动批改', and '成绩处理', which can cause the skill to activate in contexts broader than the user intended. Accidental invocation is especially risky here because the skill can access course data, automate login-related flows, and modify grading artifacts, so an overbroad trigger surface meaningfully raises the chance of unintended sensitive actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to place account credentials and session-related identifiers in config.json and automate login, but it does not warn about secure storage, plaintext exposure, or the privacy sensitivity of educational data. Because the skill also uses Chrome remote debugging and accesses a live authenticated browser context, compromise of the config file or debug environment could expose teacher credentials, student submissions, and course records.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill writes scores back by modifying the original HTML files in place, but it provides no warning about irreversible overwrite, corruption, or audit-trail loss. In a grading workflow, this is dangerous because users may lose the original downloaded records needed for verification, dispute resolution, or recovery after erroneous AI scoring.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script saves full student homework review HTML to local disk, which likely contains student names, answers, scores, and other educational records. Storing this sensitive data without minimization, encryption, retention controls, or an explicit warning increases the risk of privacy leakage if the machine, output directory, or backups are accessed by unauthorized parties.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script sends raw question text and student answers to a configurable external LLM API via requests.post, with no in-file consent, warning, minimization, or data-handling guardrails. In this skill context, the transmitted content is likely educational record data and may include personal information, making third-party disclosure a real privacy and compliance risk rather than a theoretical issue.

Ssd 1

Medium

• Confidence: 95% confidence
• Finding: Untrusted student answer content is interpolated directly into the grading prompt, so a student can include natural-language instructions such as telling the model to ignore the rubric or always return full credit. Because the script trusts the model's textual output and extracts a number from it, prompt injection can directly bias grading outcomes and undermine integrity at scale.

External Transmission

Medium

• Category: Data Exfiltration

Content

最终评分（仅输出数字）："""

    try:
        resp = requests.post(API_URL, json={
            'model': MODEL,
            'messages': [{'role': 'user', 'content': prompt}],
            'temperature': API.get('temperature', 0),

• Confidence: 92% confidence
• Finding: This code performs external transmission of grading content to a remote endpoint defined in configuration. In the context of an auto-grading skill handling student work, this is security-relevant because it transfers potentially sensitive educational content and metadata outside the local environment, with risk depending on the configured provider and transport/data governance controls.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.