T09 · Insecure Skill Coding Practices
Error
- Location
scripts/qq_hw.py:575- Finding
PowerShell Command Injection Through Unescaped File Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
QQ群作业整理
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it needs careful review because it uses authenticated QQ browser state, asks to run browser automation outside the sandbox, and contains unsafe download and PowerShell handling.
Install only in an isolated workspace or disposable account, with a dedicated QQ browser profile and explicit recipient approval for any email or WeChat sending. Avoid unattended use until dependencies are pinned, sandbox guidance is narrowed, bkn handling is documented, URL/image validation is added, and the PowerShell path injection issue is fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/qq_hw.py:368- Finding
Unrestricted URL Retrieval and Unbounded Image Decompression
- Content
View full analysis
1000: return path with urllib.request.urlopen(urllib.request.Request(url, headers=HEADERS), timeout=60) as r: data = r.read() im = Image.open(io.BytesIO(data)) if im.mode not in ("RGB", "L"): im = im.convert("RGB") im.thumbnail((1400, 1400), Image.LANCZOS) im.save(path, "JPEG", quality=82, optimize=True) return path ``` The URL reaches this function from homework data without validation: ```python try: fp = download(c["u"], c["_file"]) except Exception as e: sf(cp.add_run(f"[图片下载失败: {e}]"), BODY_FONT, 8) continue ``` ### Technical Analysis Image URLs originate from remote homework details or locally editable `hw_day_*.json` files. The downloader does not restrict the URL scheme, hostname, resolved address, port, redirect destination, response content type, or response size. `urllib.request.urlopen()` may therefore access destinations beyond the documented Tencent homework image service. In addition, `r.read()` loads the entire response into memory with no byte limit. The implementation explicitly sets `Image.MAX_IMAGE_PIXELS = None`, disabling Pillow's decompression-bomb protection before decoding attacker-controlled data. The `thumbnail()` call occurs only after the image has been opened and decoded. It therefore does not prevent memory or CPU exhaustion caused during decompression. ### Attack Path 1. An attacker publishes or injects a homework image URL, or modifies the local day JSON before document generation. 2. The URL points to an internal service, loopb ...[truncated 1046 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:29- Finding
Browser Automation Is Required to Run Without Sandbox Isolation
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:123- Finding
Runtime Installation of Unpinned Third-Party Packages
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/count_pages.ps1:4- Finding
Predictable Temporary Homework Copy Is Left on Disk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (41)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Most of the declared functionality is accurately represented by the code: it retrieves QQ group homework, gathers details including image URLs, builds DOCX files, can convert to PDF, supports multi-group and subject filtering, has text-only and multi-page options, and includes a substantial doctor/self-check flow suitable for scheduled automation. However, the description explicitly says the skill can send the result to a specified email or WeChat, and positions that as a use case. In the supplied code chunk, there is no email-sending logic, no WeChat messaging/sharing logic, and no corresponding CLI subcommand. That is a material overstatement of capability, so this should be flagged as a description-behavior mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/qq_hw.py day <日期> --refresh
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python sys.stdout.flush() # 用子进程而不是 os.execve：Windows 上 exec 的进程替换语义不可靠（输出会丢、产物可能不落盘）， # subprocess 透传 stdout 与退出码，行为可预期。QQHW_REEXEC 防递归。 env = dict(os.environ, QQHW_REEXEC="1") try: r = subprocess.run([cand, os.path.abspath(__file__)] + sys.argv[1:], env=env) sys.exit(r.returncode)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs use of shell commands, file reads/writes, browser/network access, and email/WeChat delivery, but declares no explicit tool scope or permission boundaries. In a skill that handles login state, local files, scheduled automation, and outbound sending, missing scope declarations increases the chance of over-privileged execution and accidental or unauthorized data access/exfiltration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill should be used when the user asks to 'organize, export, or send QQ group homework' and lists generic triggers such as '作业整理'、'作业文档' and '发作业给XX'. These phrases are common and underspecified, with no exclusion conditions or negative examples, increasing the risk of unintended invocation for unrelated homework or document-sending requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly supports unattended export and sending of QQ group homework, including images, to email or WeChat, but does not present a prominent privacy warning at the top-level description. Because homework content may include student information, teacher names, class/group identifiers, and attachments, silent or background transmission raises meaningful privacy and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly instructs operators to recover a real authentication-derived bkn token from browser network resources and cache it, but provides no security guidance on handling session-linked secrets, consent boundaries, storage protections, or misuse risks. In the context of a headless homework-export automation skill that accesses private QQ group content and attachments, this enables credential/session abuse and unauthorized data extraction if logs, cache files, or automation hosts are compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file title and the operational guidance throughout the document are written entirely in Chinese, and multiple instructions assume Chinese-language interaction and content handling. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not documented here.
- Content
Static analysis
No suspicious patterns detected.