Security audit

墨灵高考作文批改

Security checks for vulnerabilities and agentic risk

Overview

The skill is an essay-correction integration that matches its stated purpose, but it deserves review because it sends essays and the API key to a configurable external endpoint without strong destination controls.

Install only if you are comfortable sending essay prompts and student writing to InkCraft. Keep INKCRAFT_BASE_URL set to the official HTTPS host unless you fully trust an alternate deployment, protect the API key, and avoid including unnecessary personal information in submitted essays.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:58
Finding: Unvalidated Custom API Endpoint Can Receive Credentials and Sensitive Essay Data
Content: View full analysis
' ``` The same configurable base URL is also used when polling for results at `SKILL.md:76-80`. ### Technical Analysis The skill permits `INKCRAFT_BASE_URL` to override the official InkCraft service URL without requiring HTTPS or validating the destination hostname. It then sends `INKCRAFT_API_KEY` in both the `Authorization` and `x-api-key` headers. The submitted JSON can contain student essay content, the original examination prompt, titles, reference text, and other potentially sensitive educational data. Consequently, a malicious or mistakenly configured base URL receives both the credential and the submitted content. Because the command does not explicitly restrict protocols or redirects, the documented request flow also lacks defense in depth against insecure schemes or unexpected redirection behavior. ### Attack Path 1. An attacker gains the ability to influence the skill configuration, inherited environment, deployment template, or another source supplying `INKCRAFT_BASE_URL`. 2. The attacker sets `INKCRAFT_BASE_URL` to an attacker-controlled HTTP or HTTPS service. 3. A user invokes the composition-correction skill with an essay. 4. The skill sends the API key in two authentication headers and includes the essay data in the request body. 5. The attacker records the credentials and submitted content. 6. If the stolen key remains valid, the attacker may use it against the legitimate InkCraft API within the permissions and quotas assigned to that key. ### Impact A ...[truncated 558 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:58
Finding: Shell Command Injection Risk from Unsafe JSON Payload Interpolation
Content: View full analysis
' ``` ### Technical Analysis The skill instructs an agent to issue a shell command and represents the generated JSON payload as a single-quoted shell argument. Required payload fields such as `originalText` and `essayText` originate from user-provided content. The instructions do not prescribe a safe JSON serializer, an argument-array execution interface, or another mechanism that keeps user data separate from shell syntax. If an implementation mechanically replaces `` with JSON containing the raw essay text, an apostrophe can terminate the single-quoted argument. Additional shell metacharacters can then become executable syntax. This vulnerability is conditional on the agent or runtime performing literal command-string substitution. Implementations that serialize JSON independently and invoke `curl` without a shell are not affected. ### Attack Path 1. An attacker supplies an essay or prompt containing a single quote followed by shell syntax, such as content designed to terminate the payload argument and append a command. 2. The agent creates JSON from the supplied values and substitutes it directly into the documented `-d ''` shell template. 3. The injected quote terminates the shell string. 4. The shell interprets the remaining attacker-controlled characters as operators or commands. 5. The injected command runs with the operating-system identity and environment of the agent process. Successful exploitation requires literal inter ...[truncated 682 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description omits a clear notice that user-provided essay text will be transmitted to an external InkCraft API. This can lead to silent exfiltration of potentially sensitive educational or personal content, preventing informed consent and violating privacy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description and defaults constrain the skill to Chinese gaokao essay correction, including the default essayType of gaokao-chinese, but the document does not explicitly present this as a locale-specific limitation or provide user opt-in/choice. This can be a natural-language policy issue when a skill implicitly forces a language/locale context without clearly documenting that restriction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation guidance is broad enough that the skill may be triggered whenever a user asks for essay feedback, without clearly signaling that the content will be sent to a third-party service. That creates a consent and data-handling risk, especially for student writing that may contain personal or sensitive information.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to send user essay content to an external API using curl, which is an external data transmission channel. In context, the transmission is the intended function, but it is still security-relevant because it sends potentially sensitive user content off-platform and includes API credentials in command execution context.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
bash
BASE_URL="${INKCRAFT_BASE_URL:-https://www.inkcraft.cn}" curl -sS -X POST "$BASE_URL/api/skills/essay-correction" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $INKCRAFT_API_KEY" \ -H "x-api-key: $INKCRAFT_API_KEY" \