Security audit

Cttc Auto Learn

Security checks for vulnerabilities and agentic risk

Overview

This skill openly automates training-hour completion and runs unpinned third-party code, creating review-worthy safety and integrity risks.

Review carefully before installing. This skill may violate training-platform rules by automating course completion and simulating presence. It also executes unpinned remote code and stores reusable login state locally; only run it in a restricted environment after reviewing and pinning the source code, and avoid using it with accounts or browser sessions you cannot risk disrupting.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:52
Finding: Execution of Mutable, Unverified Remote Code
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:68
Finding: Unscoped Forced Termination of All Chrome Processes
Content: View full analysis
/dev/null || true ``` ### Technical Analysis The cleanup operation uses an image-name filter and the force-termination option. It therefore targets every accessible process named `chrome.exe`, rather than limiting termination to browser processes created by this Skill. The surrounding instructions acknowledge that unrelated Chrome processes should not be terminated, but the command does not implement that restriction. It does not record child process identifiers, validate command lines, associate processes with a dedicated browser profile, or request graceful shutdown. This violates least-privilege principles because the task only requires managing its own Playwright browser instance, while the command exercises process-control authority over unrelated browser sessions belonging to the same accessible security context. ### Attack Path 1. A user has one or more unrelated Chrome sessions open. 2. The Agent starts the Skill and reaches the environment-cleanup step. 3. The Agent executes `taskkill //F //IM chrome.exe`. 4. The operating system forcibly terminates every accessible Chrome process matching that image name. 5. Unrelated browser windows, active sessions, downloads, form data, or unsaved browser state are interrupted. ### Impact Assessment The command can cause denial of service against unrelated browser activity and may result in loss of unsaved work or interruption of active sessions. Its scope generally includes Chrome processes that the invoking user is authorized to terminate; additional scope depends on the privileges of the Agent process. The evidence does not show privilege escalation to an administrative account. The security issue is the use of existing process-control privileges beyond what is necessary for the declared au ...[truncated 18 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Phrases like '自动学习' and especially '刷学时' are euphemistic indicators of unauthorized completion/attendance inflation rather than ordinary study assistance. The wording reduces friction for abuse and makes the skill easier to present as benign despite its true operational purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough that common user language like '烟草', 'mooc', or '学时' may activate the skill in contexts where the user did not explicitly request automation. Because this skill performs high-impact actions such as login handling, browser automation, and credential-state reuse, ambiguous invocation increases the chance of unintended misuse.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The step-by-step flow operationalizes end-to-end automation of course consumption, login persistence, monitoring, and progress reporting for the purpose of '刷学时' and unattended completion. In this context, the workflow is not neutral automation; it is a structured mechanism for sustained education/compliance fraud and evasion of platform expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup step forcefully kills all Chrome processes with 'taskkill //F //IM chrome.exe' while only lightly cautioning against mistakes, but it does not clearly warn about the risk of terminating unrelated user sessions, downloads, forms, or work. This can cause data loss and disrupt other browser-based activity on the system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to save and reuse local login state in 'output/auth-state.json' but does not clearly warn users that persistent authentication material is being stored on disk. Stored session state can be stolen or reused by other local users or processes, enabling unauthorized account access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly advertises anti-idle bypass behavior ('每 25 分钟自动触发 mousemove 事件'), which is designed to defeat platform presence/engagement checks rather than merely automate playback. In the context of a training platform, this facilitates fraudulent attendance/completion and undermines integrity controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest and instructions define invocation phrases only in Chinese and present them as the expected way to use the skill. This imposes a language-specific interaction pattern without offering user choice or explicitly documenting that the skill is intentionally limited to Chinese-language use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.