T09 · Insecure Skill Coding Practices
Error
- Location
scripts/manage_bank.py:20- Finding
Path Traversal Enables Out-of-Scope JSON File Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Exam Paper
Security checks for vulnerabilities and agentic risk
Overview
The skill is broadly aligned with exam generation, but crafted question or exam data can escape its intended file boundaries or trigger unsafe PDF resource handling.
Review this skill before installing if you may import question banks or exam JSON from others. Use only trusted JSON inputs, avoid unusual subject names, and run it in a constrained workspace because malformed data can write outside the intended data directory or affect PDF generation. Pin reportlab in a virtual environment before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gen_pdf.py:51- Finding
Unsanitized ReportLab Markup Allows Resource Injection During PDF Generation
- Content
View full analysis
",">") lines = text.split("\n") html = "
".join(lines) return P(html, fontSize=10, leading=16, ...[truncated 2430 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:94- Finding
Unpinned ReportLab Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description promises a broader exam-generation system with bank management and mistake tracking. The actual code only consumes an existing JSON exam definition and turns it into two PDFs. PDF generation itself is consistent with part of the declaration, and the supported question types also align. However, the main claimed capabilities—randomly selecting from a question bank, managing the bank, and recording/reviewing wrong questions—are absent from this code chunk. Therefore the description materially overstates what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description and code overlap on some core functions: question-bank storage, random question selection, exam assembly, and wrong-answer tracking/review are genuinely present. However, the most prominent declared capability—generating exam and answer PDFs—is not implemented at all. The export command writes a JSON exam structure to disk, and there is no PDF rendering, no answer-sheet export, and no second output file for answers. In addition, the description states built-in question-bank management with add/delete/query behavior, but this code only initializes directories, lists questions, and adds questions; there is no delete or edit functionality. These are material gaps in the advertised functionality, especially because PDF generation is central to the declared purpose. The filesystem access to ~/.qclaw/workspace/exam-data is consistent with local storage for the declared purpose and is not itself suspicious or unrelated. Overall, this is a meaningful description-behavior mismatch due to missing flagship features rather than merely incomplete implementation details.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill instructs execution of local Python scripts that read environment-dependent paths and write persistent files, but it declares no explicit tool scope or permissions. This creates an authorization and transparency gap: an agent may invoke file read/write capabilities beyond what the user expects, especially because the workflow writes to ~/.qclaw/workspace and ~/Desktop.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad phrases such as 题库/试卷/generate exam that may match ordinary conversation and unintentionally activate a skill that writes files and manipulates persistent data. Accidental invocation is more concerning here because the skill can create artifacts on disk and alter stored question/error records without a narrowly scoped intent signal.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly stores persistent data under ~/.qclaw/workspace/exam-data and generates output files on the desktop, but it does not prominently warn users about these side effects before use. Hidden persistence and file creation can expose sensitive educational content, clutter user systems, or overwrite/modify local data unexpectedly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill content is written in Chinese and presents the knowledge taxonomy, templates, and guidance only in that language. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code hardcodes Chinese-language user-facing text in labels, titles, explanations, and the generated answer PDF filename, which imposes a specific language/locale on all users. The file does not offer any language selection or explain a justified region-specific restriction, so it conflicts with the policy against forcing a language without opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The answer-PDF branch for programming_fill references q without iterating over section["questions"], unlike the other section types. This will raise an exception at runtime or produce incorrect output, allowing malformed or simply ordinary input containing a programming_fill section to break answer generation and cause a denial of service for this skill's core function.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The exported exam JSON forces Chinese-language title, subtitle, labels, and section text regardless of user preference or locale. This is a natural-language policy concern because the skill imposes a specific language without any opt-in, configuration, or documented locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The error-tracking command records the student's answer and review metadata into a JSON file under the user's home directory. Although the code prints a success message after writing, it does not disclose beforehand that user-provided answer data will be stored locally, which is a data-affecting operation relevant to privacy and retention.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language instructions and examples are predominantly Chinese and assume Chinese trigger phrases, while no user language choice or locale opt-in is described. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale restriction is explicitly documented and justified.
- Content