Exam Paper Error Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 0.1.0

Overview

This is a coherent education report skill, but it should be reviewed because it saves user-derived student/exam content as local HTML without clear safeguards against active HTML injection.

Review this skill before installing. It appears intended for Chinese-language exam and vocational-education analysis, but users should only run it on content they are comfortable saving locally, choose the report location deliberately, and avoid opening generated reports from untrusted inputs unless the implementation escapes user-provided text and blocks active HTML/JavaScript.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/html-template.md:108

Finding

Unescaped User-Controlled Content in Generated HTML Reports

Content

View full analysis

Grade: [Grade] | Subject: [Subject] | Analysis Date: [Date]

Analysis Type: [Single-question analysis / Full-paper analysis / Variant generation / Error classification]

Paper Name: [Paper Name] | Maximum Score: [Maximum Score]

``` ```html

Question 1 In-Depth Analysis

1. Core Ability Assessed

[Describe the actual assessed ability and its subject-specific requirements]

2. Possible Problems Revealed by the Student's Incorrect Answer

1. Knowledge mastery [Analysis]

2. Conceptual misunderstanding [Analysis]< ...[truncated 3652 chars]

Remediation

View remediation

` → `>` - `"` → `"` - `'` → `'` 2. Explicitly classify the following as untrusted: - Pasted questions and answers - OCR or multimodal extraction results - Paper names and filenames - Student names and teacher notes - Generated text that quotes user-provided material 3. Prohibit raw user HTML. Question and answer content must be rendered as text, preferably inside escaped `

`, `

text

`, or `` elements.

4. Add a restrictive Content Security Policy to the document head:

```html

```

5. Do not allow arbitrary URLs from user content. If links are necessary, permit only explicitly validated `https:` URLs and reject `javascript:`, `data:`, and other active schemes.

6. If report generation is implemented programmatically, use a template engine with automatic HTML escaping enabled. Avoid string concatenation and unsafe rendering APIs such as `innerHTML`.

7. Add security regression tests using at least these payload classes:

```html


Open


```

8. Verify generated reports by opening them in an automated browser test and asserting that:
   - Payloads appear only as visible text.
   - No script or event handler executes.
   - No unauthorized network request occurs.
   - All six required report sections remain structurally intact.
]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description, trigger definitions, and operational instructions are entirely specified in Chinese and rely on Chinese trigger phrases, with no indication that users may choose another language or locale. This creates a natural-language policy concern because the skill appears to enforce a single language without explicit user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown trigger table includes generic phrases such as "分析这道题", "看看这道错题", "帮我分析错题", and "生成练习", which overlap with normal classroom or chat requests rather than uniquely identifying this skill. Although the file says unmatched keywords should not trigger the skill, it does not provide narrowing constraints or negative examples to prevent accidental invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L328-L329 instruct the skill to name the HTML file and save it to a user-specified or current working directory, which implies file-writing side effects. But L342 says that if file writing fails, the skill should instead prompt the user to save it manually, suggesting output may simply be returned as content. The documentation does not consistently define whether the skill is a file-writing skill or a content-generation skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L348-L355 says that before generating output the skill must read html-template.md completely and 'Do NOT load 其他参考文件'. However, earlier sub-ability flows require reading other reference files such as error-types.md and vocational-standards.md before analysis and then generating HTML afterward. This is an active contradiction in the instructions, not merely an omission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states in Chinese that the document defines the mandatory report structure and implementation, and the embedded HTML further hard-codes Chinese content. This indicates the skill is designed to produce Chinese-language output by default, but the template does not mention any user opt-in or region-specific justification for that language constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The HTML template explicitly sets <html lang="zh-CN">, which fixes the output locale to Simplified Chinese. Under the policy, forcing a specific language or locale is a violation unless the skill offers a language choice or clearly documents why the restriction is necessary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill goes beyond analysis and generation by instructing the agent to save a generated HTML report to disk, which introduces a side effect not clearly bounded by the manifest. Unprompted local file creation can surprise users, create privacy risks if reports contain student data, and expand the attack surface for unsafe path handling or unintended persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill instructs saving generated HTML files without a clear user-facing warning that local file creation will occur. Because the report may include sensitive educational content, automatic persistence can expose student data to other local users, backups, or unintended retention mechanisms.

Content

No source excerpt is available for this finding.