AI Question

• Outcome: Review
• Latest audit: May 28, 2026 · 9:52 AM UTC
• Version: 1.1.1

Overview

The skill is mostly a legitimate quiz-generation helper, but its service scripts can change the machine or stop unrelated local processes without a clear enough consent boundary.

Review the PowerShell scripts before installing or invoking service controls. Use this skill only if you are comfortable with it reading uploaded study materials, saving extracted/generated files, writing to a local QuizAI database after confirmation, starting a local FastAPI service, installing dependencies, possibly installing Python globally if missing, and stopping processes on port 8000.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to read local files, write generated JSON/XLSX outputs, run Python scripts, and invoke PowerShell commands, yet it declares no permissions or equivalent capability boundaries. This creates a transparency and policy-enforcement gap: users or hosting platforms may not realize the skill can modify local state and execute commands, increasing the chance of unintended file access or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond the high-level description by including database import operations that write into a local SQLite store, while service start/stop behavior is described in a way that may not be fully represented or bounded in the declared interface. Description-behavior mismatch is dangerous because users may consent to 'generate/normalize question bank' functionality without understanding that the skill can persist data to a database or control local services.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script silently installs Python via winget if it is missing, which modifies the host environment beyond merely starting the project service. Even though this appears intended to improve usability, package installation changes system state, may trigger elevation or policy exceptions, and introduces supply-chain and change-management risk that is broader than the user may expect from a service-start helper.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation text includes broad trigger phrases such as general requests about generating exam questions or formatting question banks, which could match ordinary conversation and cause the skill to engage unexpectedly. Overbroad activation increases the risk of unintended file processing, script execution, or data modification without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The instruction to execute the corresponding workflow whenever the user '@' mentions the skill or names one of the functions lacks boundary checks and does not require confirmation for sensitive actions. In this skill's context, that is more dangerous because the workflows include shell execution, file writes, database import, and service start/stop, so accidental activation can produce real side effects on the host environment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide explicitly instructs the agent to read the user's full uploaded materials, save generated content to a local JSON file, and then export it to Excel, but it provides no requirement to obtain explicit consent or warn the user about local persistence and handling of potentially sensitive material. In a skill that processes uploaded documents, this creates a real privacy and data-handling risk because users may not expect their source material or derived content to be stored on disk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs importing generated question banks into a local database (`data/quizai.db`) and notes that this modifies the application state, but the warning is only procedural and does not clearly frame this as a persistent data modification risk requiring explicit informed consent. This is dangerous because it can silently alter persistent system data, create unintended records, and retain user-derived content beyond the immediate session.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script forcefully kills a PID from a file and any process listening on port 8000 using taskkill /T /F, then deletes the PID file regardless of whether the target was actually the intended QuizAI service. This can terminate unrelated processes if the PID file is stale or port 8000 is used by another application, causing denial of service and operational disruption.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The manifest explicitly exposes capabilities to start and stop a local FastAPI service and to generate/write files, but it does not include any user-consent, confirmation, scope limitation, or safety messaging about modifying the local environment. In an agent setting, that increases the chance of unintended process execution, file creation, database writes, or service interruption when triggered by broad keywords or slash commands.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skill.manifest.json:100