T09 · Insecure Skill Coding Practices
Warning
- Location
assets/demo.html:477- Finding
Exposed Client-Side Administrator Credentials and Ineffective Authorization
- Content
View full analysis
- Remediation
View remediation
Security audit
校园学习空间决策助手
Security checks for vulnerabilities and agentic risk
Overview
This skill is a classroom-finding demo with sample campus data; its demo admin code is insecure for production but there is no evidence of hidden persistence, exfiltration, or real-world authority.
Install this only as a sample classroom-recommendation skill or prototype. Do not connect the included demo admin page to real classroom-management APIs or production data without replacing the hardcoded accounts, moving authorization server-side, and safely rendering all user/admin-entered text.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
assets/demo.html:693- Finding
DOM-Based Cross-Site Scripting Through Unsanitized Administrator Notes
- Content
View full analysis
'+roomId+' to '+statusCode+(note?' ('+note+')':'')); } ``` The stored value is then concatenated into HTML and assigned to an `innerHTML` sink: ```javascript if(rm.status!=='normal'){ hasAbnormal=true; var badgeClass=rm.status==='temporarily occupied'?'occupied':rm.status==='maintenance'?'maintenance':'suspended'; h+=''+rm.id+''+rm.status+''+(rm.note?'Note: '+rm.note+'':'')+''; } ... $('statusCurrent').innerHTML=h; ``` The note also enters the operation log and reaches another `innerHTML` sink at `assets/demo.html:641-644`: ```javascript else{ for(var i=0;i'+opLog[i].action+''; } } $('opLogList').innerHTML=h; ``` ### Technical Analysis The administrator-controlled note is treated as trusted markup. Because it is concatenated into an HTML string and assigned through `innerHTML`, the browser parses any supplied tags a ...[truncated 2167 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The core behavior does align substantially with the declared purpose: it searches and recommends available classrooms using classroom metadata, schedules, and feedback, which matches the empty-classroom/study-room use case. However, the code also provides additional undeclared capabilities that are materially beyond a simple student-facing recommendation skill: authentication, separate admin/student roles, and an admin interface that aggregates classroom availability statistics and feedback. These are not merely internal helpers; they are exposed functional features with a different audience and purpose. Therefore the description does not fully and accurately represent what the code chunk actually does.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says trigger phrases include specific examples 'and similar expressions,' which leaves activation scope open-ended. In a markdown skill description, this is an ambiguous trigger boundary because it does not clearly define what nearby phrasings should or should not activate the skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Phrases like '想找个安静的地方学习' are broad everyday requests that could refer to libraries, cafes, dorm spaces, or general advice rather than this classroom-finding skill specifically. The section does not provide negative examples or explicit constraints limiting activation to empty classrooms or campus teaching spaces.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document declares
lang="zh-CN", and the visible UI text throughout the file is exclusively Chinese. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy issue unless the constraint is explicitly justified or the user is offered a choice.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file includes an admin console for status management, feedback review, operation logging, and data reset, which exceeds the declared student-facing classroom recommendation purpose. Even in a demo, bundling privileged administrative capabilities into the same client-side skill expands attack surface and creates an unauthorized control path if the page is exposed beyond its intended audience.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code allows privileged modification of classroom status entirely in client-side JavaScript after login with hardcoded demo credentials. This is dangerous because any user who can access or inspect the page can impersonate the admin role, alter availability data, and influence recommendations or mislead users about room access.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The demo includes hardcoded privileged and student accounts plus role-based switching into an admin interface, which goes beyond the declared student-facing classroom recommendation scope. Even in a demo, embedded credentials and undisclosed admin functionality can expose unauthorized access paths and normalize privilege expansion if this code is reused or shipped.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript hard-codes user-facing interface strings in Chinese, such as role labels, without any visible language-selection mechanism or indication that the skill is intentionally limited to a Chinese-speaking audience. The policy requires avoiding forced language or locale constraints unless the user can opt in or the limitation is clearly justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The admin dashboard exposes aggregate classroom operational status, maintenance state, and occupancy monitoring views not described in the manifest. This creates hidden functionality and broadens the data exposure surface, which can leak internal operations details and violate least-privilege expectations for a student-facing skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The operational instructions and user-facing examples are entirely in Chinese, which can amount to a language/locale policy issue when no user opt-in or documented locale limitation is provided. The file does not state that the skill is intended only for Chinese-speaking users or a specific region requiring that language.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code maintains and renders an administrative operation log of management actions. Tracking admin actions is not a direct or obvious requirement for a skill whose stated role is recommending available study classrooms to students.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire skill reference content is presented only in Chinese, including headings, field descriptions, and usage-oriented recommendations. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file is entirely written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule for language/locale, this is a natural-language constraint without visible opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file presents all headings, instructions, and occupancy data only in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative locale is offered. There is no indication that the skill is explicitly limited to a Chinese-speaking or region-specific audience.
- Content