Security audit

Seewo Courseware Generator（希沃白板课件生成）

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its courseware-generation purpose, but it can package arbitrary local files as image resources and lacks input-size limits, so it should be reviewed before installation.

Install only if you trust the users and lesson specs that will drive generation. Keep picture sources in a dedicated trusted image folder, avoid attacker-supplied JSON specs or ENBX files, choose fresh output paths, and run the scripts with normal sandbox/resource limits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_enbx.py:839
Finding: Unrestricted Local File Read and Embedding Through Picture Sources
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_enbx.py:872
Finding: Unbounded Dimensions and Input Sizes Can Exhaust Generator Resources
Content: View full analysis
(target_path, bytes) relationships = [] # (res_id, target_path) slide_ids = [] slide_files = {} # index -> (slide_id, xml) page_bg_rids = [] # 每页背景资源 id（顺序与 page 对应） pages = spec.get("pages", []) for idx, page in enumerate(pages): # 背景 bg = page.get("background", "#FFFFFF") bg2 = page.get("background2") bg_rgb = hex_to_rgb(bg) bg2_rgb = hex_to_rgb(bg2) if bg2 else None bg_png = make ...[truncated 1872 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/validate_enbx.py:44
Finding: ENBX Validator Is Vulnerable to ZIP-Bomb Resource Exhaustion
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose centers on content generation: producing a real native Seewo .enbx lesson file from educational input. The actual code does not implement any generation pipeline, content transformation, slide creation, media packaging, or output authoring. Instead, it validates an already-existing .enbx archive by checking ZIP integrity, required filenames, XML well-formedness, slide IDs, board entries, and resource references. This is a materially different primary purpose, not merely a supporting helper, because the chunk's entire function is validation rather than creation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file's natural-language instructions are fully Chinese, beginning with the title at L001 and continuing throughout the document. Under the policy for language/locale, forcing a specific language without user opt-in or justification is a violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file directs the agent to write a JSON spec file at /workspace/spec.json, which is a file-creation operation affecting the user's workspace. While file generation is central to the skill, the description does not explicitly warn the user that files will be created/overwritten in the workspace or advise choosing safe output paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and user-facing messages are written in Chinese, and the CLI usage/result output also mixes Chinese without any option to select another language. This creates a locale-specific behavior that is not documented as region-specific or user-configurable.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: User-visible error and status strings such as file-not-found, ZIP parse failures, validation results, and resource errors are hard-coded in Chinese. For a general-purpose validation script, forcing one locale without opt-in can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.