QQ群作业整理

• Outcome: Review
• Latest audit: Aug 30, 2026 · 9:50 AM UTC
• Version: 1.2.3

Overview

The skill does what it claims, but it handles a logged-in QQ browser session outside the sandbox and processes/sends potentially sensitive homework data, so it needs careful review before installation.

Install only if you are comfortable letting the skill automate a logged-in QQ browser outside the sandbox. Use it in a dedicated or disposable browser/profile where possible, review qq_hw.json and generated homework files, prefer text-only mode for sensitive classes, and confirm every recipient and attachment before any email or WeCom send.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# ---------------- 浏览器交互 ----------------

def _run(args, timeout=300):
    p = subprocess.run([CLI] + args, capture_output=True, text=True,
                       encoding="utf-8", errors="replace", cwd=HERE, timeout=timeout)
    return (p.stdout or "") + (p.stderr or "")

• Confidence: 98% confidence
• Finding: This subprocess invocation executes an external binary chosen from the QQB_CLI environment variable. Although shell injection is avoided by passing an argument list, an attacker who can influence the environment or deployment can replace the intended helper with a malicious executable and gain arbitrary code execution in the user's context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
    with open(ps, "w", encoding="utf-8-sig") as f:
        f.write(code)
    rc = subprocess.run(["powershell.exe", "-NoProfile", "-ExecutionPolicy", "Bypass",
                         "-File", ps], cwd=HERE).returncode
    if rc != 0 or not os.path.exists(out):
        print("PDF 转换失败（rc=%s）" % rc); return 1

• Confidence: 90% confidence
• Finding: The code writes a temporary PowerShell script and then executes it with ExecutionPolicy Bypass. Even though the generated script content is locally constructed, it interpolates file paths into PowerShell source without escaping embedded quotes, so crafted output paths could break script syntax or alter behavior; the Bypass flag also weakens host protections.

Tainted flow: 'CLI' from os.environ.get (line 25, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

# ---------------- 浏览器交互 ----------------

def _run(args, timeout=300):
    p = subprocess.run([CLI] + args, capture_output=True, text=True,
                       encoding="utf-8", errors="replace", cwd=HERE, timeout=timeout)
    return (p.stdout or "") + (p.stderr or "")

• Confidence: 99% confidence
• Finding: The executable name comes from os.environ.get("QQB_CLI") and is later executed. This is a classic trust-boundary violation: environment variables are attacker-influenced in many agent/runtime setups, so a malicious value can redirect execution to an arbitrary program while preserving the appearance of normal skill behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly uses shell execution, network access, environment/session state, and file writes, yet it declares no permissions. This creates a transparency and governance gap: users and hosting systems cannot accurately assess what the skill will do before invocation, including browser-driven login detection, document generation, and outbound transmission preparation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The public description says the skill organizes QQ homework into Word and can send it, but the body also performs additional sensitive actions: detecting/storing browser-derived login/session data, converting documents to PDF, and using Word/COM-based page counting. Behavior-description mismatch is dangerous because it hides material processing steps and sensitive data handling from users, making informed consent and policy enforcement harder.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases include broad everyday language around organizing/exporting/sending homework, which may cause the skill to activate in contexts where the user did not intend browser automation, document generation, or outbound sharing. Because this skill can touch external accounts and prepare data for transmission, accidental invocation increases privacy and operational risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill description does not prominently warn that homework text and image attachments may be transmitted to external recipients via email or WeCom. Since homework may contain student names, teacher notes, class identifiers, or other personal/educational information, omission of a clear privacy warning can lead to unintentional disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Recommending dangerouslyDisableSandbox: true lowers the browser's isolation boundary and increases the blast radius of any malicious page content, extension abuse, or renderer compromise encountered during automation. In a skill that logs into QQ and processes potentially untrusted web content and attachments, disabling sandboxing makes the environment materially less safe.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill automatically downloads remote image URLs from homework content and stores them locally, which is significant because the content originates from external QQ data and may be large or malformed. In this context the danger is not merely lack of warning: the code disables Pillow's decompression-bomb protection with Image.MAX_IMAGE_PIXELS = None, increasing exposure to memory/disk exhaustion from malicious images.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.