IELTS Tuyaya Upload 雅思成绩一键上传

• Outcome: Review
• Latest audit: Jun 23, 2026 · 4:54 AM UTC
• Version: 1.3.2

Overview

The skill mostly does what it says, but it handles account tokens and “anonymous” identity data in ways users should review carefully before installing.

Install only if you are comfortable uploading IELTS review data to www.liuxue.online and with the skill using account tokens. Prefer explicit token setup over copying browser localStorage tokens into shell files, avoid anonymous mode if you do not want hostname/username-derived identifiers sent, and do not run publish-clawhub.sh unless you intentionally want it to modify local skill installations and install the clawhub CLI.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly instructs the agent to run shell commands and transmit data to external services, yet it declares no permissions. That creates a trust and governance gap: users or platforms cannot accurately assess or constrain what the skill can do before activation, increasing the chance of unintended command execution or data exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is limited to uploading review JSON files, but the behavior described by analysis extends into authentication, browser-driven authorization, account actions, local token persistence, remote querying, and skill installation/update flows. This mismatch is dangerous because users may consent to a simple upload workflow while the skill performs broader privileged actions involving credentials, browser invocation, and local state changes.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script goes beyond publishing a skill and mutates the user's local environment by backing up, moving, reinstalling, and deleting skill directories under ~/.workbuddy/skills. Even though this appears intended to keep a local copy in sync, it creates unnecessary side effects for a publishing script and can overwrite or disrupt existing local installations if run in the wrong environment.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script automatically installs a global npm package (clawhub) if missing, which changes the host environment and executes code fetched from the network. In the context of a skill whose stated purpose is uploading IELTS review files, this behavior is not necessary for end users and increases supply-chain and environment-modification risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script does more than upload a supplied review file: when no token is present, it can launch a separate authorization flow and then scrape shell RC files to recover a token. That expands the skill’s trust boundary into credential acquisition and local file inspection, which is sensitive behavior not strictly necessary for file upload and could expose or misuse authentication material.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: In anonymous mode, the script derives a stable identifier from hostname and username and transmits it, along with the local username, to a remote service. This collects and exports host/user identity metadata beyond the core need of uploading a review, creating unnecessary privacy exposure and enabling cross-session tracking of the user or machine.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: Broad trigger phrases like "dashboard" and "批量同步" can cause the skill to activate for unrelated requests, leading to unexpected shell/network actions or prompting for sensitive authentication setup when the user intended a different task. In an agent environment, overbroad activation increases the risk of unintended data transmission and privilege use.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation conditions overlap with other IELTS and dashboard-related tasks and do not clearly constrain when this upload skill should run. That ambiguity is risky because it may invoke credential checks, browser auth flows, or upload logic in contexts where the user only wanted to view information or perform a different review action.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script reads authentication tokens from shell RC files after running setup, but it does not clearly warn the user that it will inspect local shell configuration files for credentials. Accessing tokens from persistence files increases the chance of unintended credential exposure, especially in an automation context where users may not expect local secret harvesting behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The anonymous upload path sends a derived machine/user identifier and the local username without an explicit privacy warning at the point of transmission. Users may reasonably believe anonymous mode minimizes identification, but this implementation creates persistent attribution and leaks local identity details to the remote service.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill instructs users to manually extract an authentication token from browser localStorage and place it into shell configuration. This exposes a bearer credential in plaintext, risks shell history and config-file leakage, and encourages unsafe token handling practices that can lead to account compromise if the token is copied, synced, logged, or read by other local processes.

External Transmission

Medium

• Category: Data Exfiltration

Content

" "$JSON_FILE")

echo "→ POST $LEGACY_BASE/skill-review"
RESPONSE=$(curl -s -w "\n%{http_code}" \
  -X POST "$LEGACY_BASE/skill-review" \
  -H "Content-Type: application/json" \
  -H "x-api-key: $LEGACY_API_KEY" \

• Confidence: 93% confidence
• Finding: Although external transmission is core to the skill, this anonymous-mode request sends extra sensitive metadata: a built-in API key, a stable host-derived user ID, and the local username, and later exposes the API key in a printed dashboard URL. In this context, the transmission exceeds the minimum needed for upload and increases privacy and credential exposure risks.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.potential_exfiltration

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/upload.js:35