Security audit

Chaoxing Auto Grade

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for Chaoxing homework grading, but it handles teacher credentials and student records in ways that need careful review before installation.

Install only if you are authorized to process the relevant student records and send them to the configured AI provider. Use a dedicated temporary Chrome profile, avoid --remote-allow-origins=* when possible, close the debugging browser after use, protect config.json, prefer environment or OS credential storage over plaintext passwords/API keys, keep backups before applying scores, and confirm your institution permits external LLM grading of student submissions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:20
Finding: Chrome Remote Debugging Is Started with Wildcard Origin Access
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
requests== ``` 2. Include every direct dependency used by the scripts, including `requests`. 3. Generate and distribute hashes for approved artifacts, then install with hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use an explicitly trusted package index and avoid unreviewed mirrors. 5. Maintain a lock file and periodically review dependency advisories before updating pinned versions. 6. Recommend installation in an isolated virtual environment rather than the system Python environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_homework.py:254
Finding: Credentials Are Interpolated Directly into Executed JavaScript
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior includes sensitive operations such as automated login with stored credentials and handling of student assignment data, but those risks are not clearly and consistently disclosed in the skill’s declared purpose. A mismatch between stated and actual behavior undermines informed consent and can cause users to run a skill that accesses accounts or processes educational records in ways they did not anticipate.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs users to send subjective questions and student answers to an external LLM API for grading without a clear warning about transmitting potentially sensitive educational data off-platform. This can expose personally identifiable information, student work product, and academic records to third-party services, with privacy, compliance, and data retention risks.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill describes capabilities that require file read/write and network access, but it declares no explicit tool scope or permissions boundaries. That creates an authorization ambiguity where an agent runtime may grant broader access than users expect, increasing the risk of unintended data access, exfiltration, or file modification during grading and download workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description lists activation terms such as “超星”, “学习通”, “自动批改”, and “成绩处理”, several of which are generic enough to appear in normal discussion rather than an intentional skill invocation. The file does not provide narrower trigger constraints, explicit invocation syntax, or negative examples to distinguish when the skill should versus should not activate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill writes AI-generated scores back into the original downloaded HTML files in place, but it does not clearly warn users that source artifacts will be modified. In-place modification can destroy evidentiary originals, make audit/review difficult, and propagate incorrect grades if the scoring output is wrong or tampered with.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The module docstring says the precondition is that the user is already logged in, with a parenthetical note that the script may auto-login, while the manifest description focuses on homework download and grading workflows. In code, login automation is a substantial behavior: it reads configured credentials and submits them into the Chaoxing login form, which goes beyond simple download orchestration and introduces account-access functionality as part of the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script saves full student review HTML to disk under per-student filenames, which likely contains personal data, grades, answers, and course context. Persisting sensitive educational records without minimization, access controls, retention limits, or operator warning increases the risk of privacy breaches and unauthorized disclosure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes downloading homework review HTML, revealing objective questions, AI grading, and cleaning HTML for scoring data. Implementing automated account login with configured username/password is a separate capability that is not clearly justified or declared by that purpose, especially since the rest of the workflow could operate on an already logged-in browser session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script reads stored account credentials from configuration and injects them into the browser login form, encouraging plaintext credential storage and automated reuse. In the context of a teacher portal, compromise of the config file or host system could expose institutional credentials and permit unauthorized access to student records and grading functions.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 80% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · scripts/download_homework.py (reported line 248)May include surrounding context.
python
await cdp(ws, 1, 'Page.navigate', {'url': LOGIN['passport_url']}) await asyncio.sleep(3) # Fill login form await js(ws, f'document.querySelector("#phone")?.click()') await js(ws, f'document.querySelector("#phone")?.value = "{account}"') await js(ws, f'document.querySelector("#pwd")?.value = "{password}"')

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The requests.post call transmits grading prompts containing student questions and answers to an external API endpoint defined in configuration. Because this skill operates on educational records, the context increases sensitivity: even intended exfiltration to a configured SaaS model can violate privacy expectations or institutional rules if not clearly disclosed, minimized, and governed.
Content: Scanner excerpt · scripts/grade_subj.py (reported line 56)May include surrounding context.
python
最终评分（仅输出数字）：""" try: resp = requests.post(API_URL, json={ 'model': MODEL, 'messages': [{'role': 'user', 'content': prompt}], 'temperature': API.get('temperature', 0),

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends student question text and answers to a third-party API for grading, but the code and docstring provide no warning, consent flow, or data-handling notice. In an education context this can expose potentially sensitive student data to external processing, creating privacy, compliance, and data-governance risk even if the transmission is functionally intended.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Multiple user-facing configuration placeholders and examples are written only in Chinese, such as provider guidance, course/student names, and filesystem path examples. This imposes a specific language/locale on users without any opt-in or documented justification, which matches the policy-violation category for language/locale constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The output document is explicitly marked with lang="zh-CN", which forces a specific language/locale in the generated artifact. The file does not provide a user opt-in, configuration option, or comment explaining that the skill is intentionally limited to a Chinese-only context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file's docstring and multiple user-facing messages are written only in Chinese, which imposes a specific language on users without opt-in or alternative locale support. This is a natural-language policy concern because the skill does not indicate that it is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script reads an API key from configuration and uses it for authenticated requests, but there is no user-facing notice beyond a missing-placeholder check. Under this rule, access to sensitive credentials should have some visible disclosure via comments, docstrings, logs, or prompts unless already clearly warned elsewhere.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The embedded prompt is entirely in Chinese and directs the model's behavior in a single language, with no option for user language choice. The file does not document that this skill is intentionally limited to a Chinese-language environment or provide any opt-in for locale selection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.