Security audit

析题

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese competitive-programming teaching aid that generates solution writeups and visual materials, with disclosed but manageable risks from external rendering libraries and local file generation.

Install only if you want a Chinese-language competitive-programming writeup generator. Generated HTML may contact CDNs when opened, and the SVG helper should be run with a user-controlled output directory rather than the bundled /var/tmp path on shared machines.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: templates/example.html:490
Finding: Unverified and Mutable Third-Party Runtime Dependencies
Content: View full analysis
``` ```html ``` ```typst #import "@preview/cetz:0.3.4" #import "@preview/fletcher:0.5.4" #import "@preview/codly:1.3.0": * ``` ### Technical Analysis The generated HTML loads executable JavaScript and stylesheets directly from public CDNs. No Subresource Integrity hashes are specified, so the browser cannot verify that downloaded resources match versions reviewed by the project author. Some dependencies use floating major-version selectors, including `mermaid@11` and the Highlight.js theme at `@11`. Resources resolved by these selectors may change without a corresponding update to this project. Even references with exact package versions remain dependent on the integrity of the CDN, package registry, and upstream release. The Typst theme also imports three external preview packages. Their source is not vendored into the project, so compilation depends on externally distributed package contents. Any code execution or resource access remains subject to the Typst runtime ...[truncated 1873 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: templates/gen_figs.py:67
Finding: Predictable Shared Temporary Output Path Permits Symlink-Based File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向用户的“题解生成/题目分析/代码精讲”能力，核心应是解释、分析、引导思考。实际代码并不执行任何题目求解、代码讲解、交互式启发或文本生成逻辑，而是定义若干 SVG 绘图函数，拼接固定帧内容，并批量保存 fig_a.svg 到 fig_g.svg。本地写文件也是声明中未体现的能力。虽然这些图可能服务于题解展示，但代码主功能明显是“生成配套教学插图”，与声明的主要用途不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/example.html (reported line 7)May include surrounding context.
html
<meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>ABC457 A-E 题解</title>  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.21/dist/katex.min.css">  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@11/styles/github-dark.min.css">

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description promises 'heuristic problem-solution generation' and emphasizes teaching thought processes. The body of the skill, however, mandates substantial document-production behavior: selecting output formats, generating typst/HTML files, compiling PDFs, validating pages, embedding Mermaid/KaTeX/anime.js assets, and even requiring illustrations, which is materially broader than explanation generation alone.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description is entirely in Chinese and frames the skill's behavior around Chinese-language instructional output. There is no indication that users may choose another language or locale, which can violate a language/locale policy requiring opt-in rather than a forced language default.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill is granted Bash and directed to use external retrieval even though its core task is explanatory tutoring. That expands the attack surface: prompt-injected problem statements or URLs could cause unnecessary shell execution, compilation, or remote content ingestion, increasing the chance of unsafe command use or processing adversarial external data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: These lines prescribe a fixed teaching voice, including specific Chinese phrasing conventions and bans on alternative forms of address, but do not allow the user to choose language or locale. This is a natural-language policy concern because the skill appears to enforce a particular linguistic mode rather than adapting to user preference.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill instructs inclusion of multiple third-party CDN-hosted scripts and styles for generated HTML. This creates a supply-chain and privacy risk: users opening the produced file may fetch remote code from CDNs, leak metadata, or be exposed to compromised upstream assets, which is unnecessary for many educational outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill hardcodes Chinese-language output and stylistic requirements across the entire writing flow without indicating that this is conditional on user preference. This can override user intent, reduce accessibility for non-Chinese speakers, and cause the agent to disregard explicit language or format requests, which is a prompt-safety and policy-compliance issue even though it is not an exploit in the traditional code-execution sense.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template imports multiple third-party assets from public CDNs at render time, creating a supply-chain and privacy risk: a compromised CDN, tampered package, or downgraded dependency could execute arbitrary script in the page context. For an educational solution-rendering skill, these remote dependencies are not strictly necessary to fulfill the core purpose, so the exposure is avoidable and increases attack surface.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains natural-language descriptions entirely in Chinese, beginning with the module docstring at L002, and the generated figure titles/messages throughout the file are also fixed to Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file's natural-language instructions, explanations, and labels are consistently written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without opt-in is a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template’s natural-language headings and usage instructions are written entirely in Chinese and present the expected output structure in that language. This can amount to a locale/language policy issue when the skill implicitly requires a specific language without offering an alternative or user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document sets lang="zh-CN", and the visible content throughout the page is written exclusively in Simplified Chinese. Under the stated policy, forcing a specific language or locale without offering user opt-in or documenting a justified region-specific constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The page includes animation capability and related script handling beyond the core need of displaying heuristic explanations, which broadens the client-side execution surface without clear justification. Extra libraries and dynamic behaviors increase the chance of dependency compromise, DOM-based issues, or future unsafe use of untrusted content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains user-facing skill examples and instructions exclusively in Chinese, but does not mention that the skill is Chinese-only or offer an opt-in language choice. That can violate a language/locale policy when users may reasonably expect language flexibility.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This SVG contains natural-language labels such as “窗口[0,2]：48+73=121>83 → 不吃48” and similar Chinese text, but there is no indication that the language is optional or that the asset is intended only for a Chinese-language context. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The SVG contains embedded natural-language labels such as "步1", "步2", and "步3" in Chinese. Since SQP-3 applies to all file types, this is a language-policy concern when the asset mandates a specific language without any visible opt-in or justification that it is intended only for a Chinese-language audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The SVG contains embedded Chinese text labels such as "步1：BFS 染色中" and related captions, which fixes the skill content to a specific language. For a file type covered by the all-files policy rule, this is a natural-language locale constraint with no visible opt-in or alternative language support.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This SVG contains user-visible labels in Chinese such as "步1：凸多边形（顶点 0-4）", "步2：切 1→3 分两片，右侧 P′（蓝）", and "步3：面积加权求重心 G（红点）". Under the natural-language policy rule, forcing a specific language without opt-in or documented justification is a locale-policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The theme sets lang: "zh" as the default, and surrounding comments and labels indicate the template is authored for Chinese output. This is a natural-language locale constraint that applies by default rather than being presented as an explicit user choice or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.