Tencent Yuanbao Gaokao - Score-to-Rank Lookup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 0.1.3

Overview

The skill is a coherent GaoKao score/rank lookup helper, with some disclosure and output-quality issues but no evidence of hidden persistence, credential access, destructive behavior, or exfiltration.

Install only if you are comfortable with the skill running a bundled Python script and querying Tencent's GaoKao service for lookup data. Avoid relying on strict JSON stdout until the extra prints are fixed, and do not use the misnamed --ip argument unless the publisher documents or removes it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description says the skill queries score-ranking data, but the analyzed behavior indicates undeclared functionality such as an extra --ip parameter that can substitute for province input. Undocumented inputs and behavior mismatches are dangerous because they can enable hidden data collection or execution paths that users and reviewers did not consent to, weakening trust boundaries and potentially exposing location-derived or other unintended data flows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instructions prescribe a fixed Chinese follow-up prompt (您想查询哪个省份的信息呢？), and the overall skill content assumes Chinese-language interaction throughout. This is a language-policy issue because the skill does not offer user opt-in or state that it is intentionally limited to Chinese for a documented regional use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to run a local Python script as part of normal handling, but gives no user-facing disclosure, sandboxing guidance, or constraints on execution. Executing local code increases the attack surface because downstream script behavior may access files, environment data, or network resources, and users are not informed that code will run on the host system.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script explicitly promises JSON-only stdout for downstream LLM consumption, but later emits plain-text output such as parsed arguments and labels to stdout. In an agent pipeline that expects strict JSON, this can cause parser failure, result confusion, or prompt/output injection through unstructured text mixed with machine-readable data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The --ip parameter is mislabeled as a rank-query input but is actually used as a fallback province value, creating a parameter-confusion issue. In agentic use, callers may pass an IP address or other unintended string, causing untrusted input to alter network query parameters and potentially leading to incorrect retrieval, policy bypass, or downstream reasoning on attacker-controlled results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Printing the parsed argparse namespace to stdout violates the documented JSON-only contract and introduces non-JSON content into the main output channel. In automation or LLM-tool contexts, this can break deserialization, leak invocation details, and create an injection surface where user-supplied argument values are echoed into trusted downstream processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON file consists entirely of Chinese language strings and provides no indication that users can choose another language or that the skill is intentionally limited to a Chinese-specific context. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This JSON file contains only Chinese-language category labels and provides no indication that the skill is region-specific or that users can opt into this locale. Under the policy, fixed language/locale behavior without user choice or documented justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This code sends user-provided query parameters such as place, year, and classify to gaokao.search.qq.com via HTTP requests. Although there is a stderr debug line showing the URL, there is no explicit warning in comments or user-facing documentation that user inputs are transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This JSON file contains only Chinese category names and provides no indication that the skill is region-specific or that users can opt into this locale. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The file contains only Chinese-language values with no indication that users can choose another language or locale. Under the stated policy, hard-coding a single language can be a natural-language policy concern when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.