AI Question

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 1.1.1

Overview

The skill is mostly a disclosed QuizAI question-bank helper, but its service scripts can install software and force-stop unrelated local processes without enough safeguards.

Install only if you intend to use it inside the QuizAI project and are comfortable with local file processing, database writes, and a local FastAPI service. Review or modify the start and stop PowerShell scripts before using them: prepare Python/dependencies yourself, avoid automatic winget or pip installs during startup, and ensure the stop script only terminates the intended QuizAI process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/start_question_service.ps1:32

Finding

Automatic Installation of Unreviewed Runtime and Project Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/stop_question_service.ps1:24

Finding

Shutdown Script Can Forcefully Terminate Unrelated Processes

Content

View full analysis

$null | Out-Null if ($LASTEXITCODE -eq 0) { Write-Host "Stopped process tree PID $processId" return $true } Stop-Process -Id $processId -Force -ErrorAction Stop Write-Host "Stopped process PID $processId" return $true } catch { return $false } } if (Test-Path $servicePidFile) { $savedPid = (Get-Content $servicePidFile -Raw).Trim() if ($savedPid -match '^\d+$') { if (Stop-ProcessTree ([int]$savedPid)) { $stopped = $true } } Remove-Item $servicePidFile -Force -ErrorAction SilentlyContinue } $conns = @(Get-NetTCPConnection -LocalPort 8000 -State Listen -ErrorAction SilentlyContinue) foreach ($c in $conns) { if (Stop-ProcessTree $c.OwningProcess) { $stopped = $true } } ``` ### Technical Analysis The shutdown script forcefully terminates a process tree based only on a numeric PID from `data/quizai.pid`. It does not verify the process executable, command line, creation time, owner, project path, or relationship to the expected QuizAI instance. A PID is not a durable process identity. If QuizAI exits and Windows later reuses its PID, the stale PID file may identify an unrelated process. If an attacker or another local process can write to the project data directory, it can also place a chosen numeric PID in the file. The fallback logic is broader still: it enumerates every process listening on local port 8000 and forcefully terminates each process tree. There is no validation that the listener is the QuizAI application. The use of `taskkill /T /F` may also terminate child processes of the selected ta ...[truncated 1375 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个较完整的题库处理与服务控制技能，但提供的代码片段实际只是“资料文本抽取”工具，用于把上传文件转成纯文本供后续模型阅读。它没有任何生成题目、规范题库、输出 Excel、调用模型、或管理 Python 服务的逻辑。虽然“从上传资料出题”流程中，文本提取可以算支持性步骤，但该片段的主要功能与声明的主要用途存在明显差异，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明描述涵盖三类能力：1) 从上传资料生成题库 Excel，2) 规范/格式化题库，3) 启动/停止 Python 刷题服务。该代码块的实际职责较窄：它要么把已有 JSON 题库交给另一个脚本导出为 Excel，要么先提取资料文本，然后提示用户去按指南用对话模型生成 JSON，再手动执行导出命令。因此，代码并未直接完成“模型出题生成题库”的核心过程，只是为该流程做前置提取和后置导出。更明显的是，声明中的启动/停止服务能力在此代码中完全不存在。基于给定代码块，声明相对实际行为明显过宽，属于描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明的核心功能是生成/规范题库以及启动或停止服务；但提供的代码仅执行本地文件题库导入。它支持 JSON 和 Excel 文件输入，必要时对 JSON 题目调用 prepare_export_questions 做整理/打乱选项，然后初始化数据库并将题库存入 SQLite。代码中没有对话式模型交互、没有从上传资料生成新题目、没有导出或规范 Excel 文件、也没有任何启动/停止 Python 服务的逻辑。因此其实际主要用途与声明描述存在实质性偏差。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill instructs the agent to read files, write generated JSON/XLSX outputs, and execute shell/PowerShell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent or host may permit broader file-system or shell access than users expect, increasing the risk of unintended command execution or modification of local project data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation description is broad and includes generic exam-related phrases, which can cause the skill to trigger for loosely related requests. Because the skill can read user-supplied files, write outputs, and run local scripts or services, over-broad invocation raises the chance of unintended execution in contexts where the user did not mean to authorize those actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction that the agent should execute the corresponding chapter whenever the user mentions the listed functions is ambiguous and permissive. In this skill's context, ambiguity is more dangerous because execution paths include shell commands, local service control, and database writes, so a mistaken activation can have real side effects on the host environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document title and all operational guidance are written as a mandatory Chinese-only generation guide, and nowhere offers the user a language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_question_bank.py (reported line 48)May include surrounding context.

python

"-o",
            args.output,
        ]
        return subprocess.call(cmd)

    extract_script = SCRIPTS / "extract_material.py"
    extract_out = Path(args.extract_out)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_question_bank.py (reported line 56)May include surrounding context.

python

extract_out = ROOT / extract_out

    cmd = [sys.executable, str(extract_script), *args.inputs, "-o", str(extract_out)]
    code = subprocess.call(cmd)
    if code != 0:
        return code

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script automatically performs a system-wide winget install of Python when python is not found, which goes beyond the minimal action of starting an application service. In an agent/skill context, this can cause unexpected host modification, trigger privileged package installation flows, and expand the blast radius if the skill is invoked in sensitive environments where users did not explicitly consent to software installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest explicitly advertises capabilities to start and stop a local FastAPI service and even kill the QuizAI process, but it provides no user-facing warning, confirmation requirement, or scope limitation in the manifest metadata. In agent-driven environments, this can lead to unintended process control actions, service interruption, or changes to the local development environment when a user only loosely matches a trigger phrase.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The keyword "考试题目" is generic natural language that could appear in ordinary user requests about exams, not specifically this skill's workflow. In a manifest trigger list, such a broad phrase increases the chance of unintended invocation when the user is merely discussing exam questions rather than asking to run this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The RuntimeError string is written only in Chinese, which imposes a specific language on users regardless of their locale or preferences. This is a natural-language policy concern because the file does not provide an alternative language or indicate that Chinese is a documented, region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is written only in Chinese, and the script's CLI description and status/error messages are also Chinese-only. This creates a locale/language policy concern because the skill imposes a specific language on users without any opt-in or documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring, argparse descriptions, error messages, and success output are all hard-coded in Chinese throughout the script. This can violate a language/locale policy when a skill imposes a specific language on users without opt-in or justification.

Content

No source excerpt is available for this finding.