搬题姬

• Outcome: Review
• Latest audit: Aug 14, 2026 · 7:16 AM UTC
• Version: 2.7.0

Overview

The skill is coherent for importing programming-contest problems, but it asks the agent to run generated code and use destructive filesystem commands on the user's desktop without enough safeguards.

Install only if you are comfortable with a skill that creates and deletes desktop work folders, reads user-specified local problem files or attachments, browses OJ pages, compiles and runs generated C++ programs, and produces zip archives. Use it in a disposable workspace or sandbox, review paths before execution, and avoid invoking it from vague contest-related prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The program compiles and executes local code via shell commands (`g++ std.cpp ...` and `./std < ... > ...`). In this skill context, `std.cpp` is part of imported problem material and may be untrusted, so the skill can execute attacker-controlled code on the host rather than merely transform files or generate data.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The step instructs the agent to rename the working directory as a side effect of merely extracting problem metadata. This expands scope from read/parse operations into filesystem mutation, and because the move is constructed from variables without quoted paths or safety checks, it can cause unintended relocation, overwrite-like disruption, or downstream path confusion if the detected base directory or PID is wrong.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The manifest-level trigger phrases are very broad for a skill that can read local files, browse external sites, and write/archive content on the user's desktop. Phrases like "AtCoder", "Codeforces", "搬一下", or generic references to test data can cause the skill to activate in conversations where the user did not clearly intend to invoke filesystem and browser automation, increasing the chance of unintended data access or modification.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The keyword list is ambiguous and insufficiently scoped, containing common terms such as "搬题", "搬一下", and names of popular OJ platforms. In this skill's context, accidental activation is especially risky because the workflow performs local directory creation, copying, editing, zipping, and optional web access, so an unrelated discussion about programming contests could trigger privileged actions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The test-data-generation trigger examples are vague enough that ordinary requests like "写测试数据" or "出测试数据" may invoke the skill without clear user intent to create files and packaged outputs. Although this path is somewhat narrower than full problem import, it still performs code generation, file writes, and packaging, so mistaken activation can cause unwanted filesystem changes and external content processing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code deletes existing files with `rm -rf testdata/*.in testdata/*.out testdata/*.zip` without any confirmation, dry-run, or safety checks. Even though the path is somewhat scoped, destructive shell deletion can cause unintended data loss and is risky in an automation skill that users may run repeatedly or in the wrong working directory.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to run `rm -rf` against desktop-relative paths without any confirmation, dry-run, or path validation. Although the target is intended to be a work directory, destructive deletion in an agent skill is risky because variable expansion, unexpected path values, or repeated execution could delete user data in a sensitive location such as the desktop.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented `mv` operation performs a write/destructive move on the user's filesystem without warning or confirmation. In an agent context, even a simple rename can break references, disrupt concurrent tasks, or move the wrong directory if workspace detection is inaccurate, making this materially riskier than a normal instructional note.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The step explicitly instructs the agent to read user-supplied local files, perform OCR on images, parse HTML, and generate or append output files, but it provides no requirement to obtain explicit confirmation, warn about privacy implications, or constrain file access/output locations. In an agent setting, this can lead to unintended access to sensitive local data or filesystem modification beyond what the user expects, especially because the workflow scales from single files to whole directories and automatically transitions into a packaging pipeline.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The command `rm -f {WORK_DIR}/std {WORK_DIR}/mkdata {WORK_DIR}/*.exe` deletes files in a user-controlled path without safeguards, confirmation, or validation that `{WORK_DIR}` points to the intended package directory. If `{WORK_DIR}` is malformed, empty, or attacker-influenced, this can cause unintended data loss on the desktop or elsewhere.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: Instructing the agent to send the zip file to the user without a final content review can disclose unintended files bundled in `{WORK_DIR}`, including secrets, local paths, or leftover tooling artifacts. This is more concerning in this skill because the package is assembled from a filesystem workspace and earlier steps rely on shell operations that may leave extra files behind.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs compiling and executing generated C++ programs and creating archives without any explicit confirmation, safety gating, or sandbox requirement. Because the source material comes from user-provided problems and generated code artifacts, this can lead an agent to run untrusted or insufficiently reviewed code on the host, risking arbitrary command execution, resource abuse, or unsafe filesystem modifications within the working environment.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instruction explicitly tells the agent to copy local images or attachments into a workspace directory, which can move user-local files without an explicit consent step or provenance check. In an agent setting, this creates a real risk of unintended exfiltration or over-collection of local content, especially if a problem statement references non-remote assets or if the source page is untrusted/manipulated.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs `rm -rf $BASE_DIR/work_{PID}` before recreating a working directory, but provides no validation, quoting, or user-facing confirmation. If `BASE_DIR` or `PID` is empty, malformed, or unexpectedly expanded, this can delete unintended filesystem paths; in an agentic environment, that risk is amplified because commands may be executed automatically.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The cleanup and packaging instructions include deletion commands such as `rm -f {WORK_DIR}/std ...` and `rm -f work_*/*.zip` without safeguards or warnings about irreversible removal. Wildcards and templated paths are especially risky in automation: if variables are wrong or the current directory is not what the author expects, unrelated files may be deleted.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

void mk_in() {
    // 创建testdata目录
    if (system("rm -rf testdata/*.in testdata/*.out testdata/*.zip") != 0) {
        cerr << "清理旧数据失败" << endl;
    }

• Confidence: 88% confidence
• Finding: The use of `system("rm -rf ...")` is a dangerous operational pattern because it delegates destructive behavior to the shell and relies on the current working directory and shell expansion semantics. In a skill that processes imported problem packages, this increases blast radius if execution context is manipulated or if users do not expect prior artifacts to be forcefully removed.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.