Security audit

刷题网页生成器

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only quiz HTML generator whose local storage and export features match its stated offline study purpose.

Before installing, understand that generated quiz files will contain answer keys in the HTML and may store progress in the browser's localStorage. Exported learning-record JSON files can reveal student progress or wrong answers, so avoid using them on shared computers without clearing local data and review generated import/export handling before classroom deployment.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Confidence: 96% confidence
Finding: The manifest explicitly instructs the agent to activate this skill for a very broad set of phrases even when the skill name is not mentioned. This can cause inappropriate routing, override user intent, and increase the chance the skill handles requests outside its safe or intended scope, especially when combined with implicit behavior from another skill.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill requires persistent storage in localStorage and import/export of learning records, but provides no privacy notice, retention guidance, or validation expectations for imported data. This creates avoidable privacy and integrity risks, particularly for student data, shared devices, and malformed or oversized imported files.

Static analysis

No suspicious patterns detected.