高考志愿填报助手

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:16 AM UTC
• Version: 1.1.1

Overview

This is a coherent Gaokao planning skill with optional local CSV helpers, with practical caution needed when using untrusted CSV data.

Install only if you want a Chinese Gaokao admissions-planning workflow. Use official data where possible, be careful with CSV files from unknown sources, and avoid opening generated CSVs in a spreadsheet unless the source data is trusted or formula-prefixed cells have been neutralized.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/normalize_admission_data.py:67

Finding

Spreadsheet Formula Injection in Generated CSV Files

Content

View full analysis

Vulnerability Details

File Location: scripts/normalize_admission_data.py:67-76, scripts/shortlist_builder.py:43-47, and scripts/risk_scoring.py:49-53
Vulnerability Type: CSV formula injection
Risk Level: Medium

Vulnerable Code

scripts/normalize_admission_data.py:67-76:

python

for row in reader:
    normalized_row = {field: "" for field in output_fields}
    for raw_key, value in row.items():
        key = field_map.get(raw_key or "", raw_key or "")
        text = (value or "").strip()
        normalized_row[key] = clean_number(text) if key in NUMERIC_FIELDS else text
    rows.append(normalized_row)

with outfile.open("w", encoding="utf-8", newline="") as dst:
    writer = csv.DictWriter(dst, fieldnames=output_fields)
    writer.writeheader()
    writer.writerows(rows)

scripts/shortlist_builder.py:43-47:

python

rows.sort(key=lambda r: abs(int(float(r["min_rank"])) - args.rank))
with args.out.open("w", encoding="utf-8", newline="") as dst:
    writer = csv.DictWriter(dst, fieldnames=fields)
    writer.writeheader()
    writer.writerows(rows[: args.limit])

scripts/risk_scoring.py:49-53:

python

rows.sort(key=lambda r: (["冲", "小冲", "稳", "保", "垫"].index(r["risk_band"]), abs(float(r["gap_ratio"]))))
with outfile.open("w", encoding="utf-8", newline="") as dst:
    writer = csv.DictWriter(dst, fieldnames=fields)
    writer.writeheader()
    writer.writerows(rows)

Technical Analysis

The scripts accept externally supplied admission CSV files and preserve nonnumeric cell contents without neutralizing spreadsheet formula prefixes. Values beginning with =, +, -, or @ can therefore survive normalization, shortlisting, and risk scoring unchanged.

Python's csv module correctly quotes CSV syntax but does not prevent spreadsheet applications from interpreting cell values as formulas. If a generated file is opened in software such as ...[truncated 1684 chars]

Remediation

View remediation

Remediation Suggestions

• Sanitize every untrusted text cell before writing it to a CSV intended for spreadsheet use.
• Prefix values whose first non-whitespace character is =, +, -, or @ with an apostrophe or another documented neutralization marker.
• Apply the protection consistently in all CSV-producing scripts rather than only in the normalization stage, because users may invoke the tools independently.
• Consider a shared helper such as:

python

DANGEROUS_FORMULA_PREFIXES = ("=", "+", "-", "@")

def spreadsheet_safe(value: str) -> str:
    if value.lstrip().startswith(DANGEROUS_FORMULA_PREFIXES):
        return "'" + value
    return value

• Preserve legitimate negative numbers only for fields explicitly validated as numeric. Treat arbitrary text fields beginning with - as potentially unsafe.
• Document whether output is intended for machine processing or direct spreadsheet viewing.
• Add regression tests covering all dangerous prefixes, leading whitespace, tabs, and payloads in every text column.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/rank_matcher.py:32

Finding

Terminal Escape-Sequence Injection Through Admission Records

Content

View full analysis

Vulnerability Details

File Location: scripts/rank_matcher.py:32-38
Vulnerability Type: Improper neutralization of terminal control characters
Risk Level: Low

Vulnerable Code

python

for _, row in sorted(rows, key=lambda item: item[0])[: args.limit]:
    school = row.get("school_name", "")
    group = row.get("major_group_code", "")
    major = row.get("major_name", "")
    min_rank = row.get("min_rank", "")
    min_score = row.get("min_score", "")
    print(f"{school}\t{group}\t{major}\tmin_rank={min_rank}\tmin_score={min_score}")

Technical Analysis

The rank matcher prints attacker-controlled CSV fields directly to an interactive terminal. It does not remove ASCII control characters, ANSI escape sequences, or Operating System Command sequences.

A crafted school or major field can contain terminal instructions that alter colors, move or erase the cursor, change the terminal title, create deceptive hyperlinks, or otherwise manipulate displayed output. Some terminal emulators support additional OSC behaviors, although the exact effects are terminal-dependent.

This is output injection rather than shell command injection: the Python script does not invoke a shell or execute the field as code. Nevertheless, terminal manipulation can hide warnings, falsify visible records, or facilitate social engineering.

Attack Path

1. An attacker inserts ANSI or OSC escape sequences into a text field of an admissions CSV.
2. The victim runs rank_matcher.py against the crafted file in an interactive terminal.
3. The script prints the field unchanged.
4. The terminal emulator interprets the embedded control sequence.
5. The attacker-controlled sequence modifies the terminal display or triggers another terminal-supported behavior.

Impact Assessment

The primary impact is integrity loss in terminal output. An attacker may conceal records, overwrite displayed text, render deceptive hyperli ...[truncated 265 chars]

Remediation

View remediation

Remediation Suggestions

• Remove control characters from all untrusted fields before terminal output.
• Permit only tab, newline, and printable characters where explicitly required; for single-record fields, tabs and newlines should also be replaced or escaped.
• Strip ANSI Control Sequence Introducer and OSC sequences rather than relying only on basic printable-character checks.
• Consider rendering unsafe bytes visibly with repr() or escaped Unicode notation.
• Provide a structured output option such as JSON for downstream processing.
• Add tests containing ESC, BEL, carriage return, backspace, embedded newlines, CSI sequences, and OSC hyperlink sequences.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

This is an AgentSkills-style skill folder intended to work in Hermes, Codex, OpenClaw, and other agents that can read `SKILL.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

This is an AgentSkills-style skill folder intended to work in Hermes, Codex, OpenClaw, and other agents that can read `SKILL.md`.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

Scripts assume CSV input. For spreadsheets, export the relevant sheet to CSV first.

## Output Rules

For a full recommendation, include:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains user-facing output templates exclusively in Chinese, which can force a specific language/locale on users without opt-in. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The document uses Chinese-only band labels and later prescribes Chinese-language phrasing examples, which indicates a language constraint in the skill's natural-language behavior. There is no opt-in, alternative locale, or statement that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'Language' section explicitly instructs use of Chinese phrases such as '相对稳妥' and '有一定冲刺风险' while providing no option for the user's preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README presents the skill entirely in Chinese-focused context and names, with no indication that users may choose their preferred language for interaction or output. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless clearly documented as a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes multiple field definitions and enumerations in Chinese alongside English labels, but does not explain that the contract is intended specifically for Chinese admissions datasets or offer any user opt-in regarding language/locale. Under the policy rule for natural-language violations, forcing a specific language or locale without explicit justification can be a violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This markdown guidance contains substantial Chinese-language terminology embedded throughout the checklist, which effectively assumes the user can read Chinese. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in, and no language-choice or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains multiple Chinese-only list items alongside English text, which can impose a language requirement on users who do not read Chinese. The file does not state that the skill is China-specific or provide an opt-in or alternative language, so it may violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing instructions that require inputs such as "省份和年份" and other Chinese-only terms, but it does not state that the workflow is intended only for Chinese-speaking users or offer an English/localized alternative. That can amount to a language/locale policy issue because the skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.