qsnctf-practice-dynamic

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:55 PM UTC
• Version: 1.0.0

Overview

This skill is a narrow QSNCTF leaderboard/activity viewer with disclosed network calls and no evidence of hidden persistence, credential access, or destructive behavior.

Before installing, expect the skill to contact www.qsnctf.com and print returned leaderboard/activity data. Use a virtual environment and consider pinning requests; avoid running dependency installation with elevated privileges. If terminal output safety matters, sanitize remote fields before printing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:125

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:125
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

pip install requests

Technical Analysis

The installation instructions retrieve requests without specifying a reviewed version or validating an integrity hash. As a result, the installed code depends on whichever release the configured package index resolves at installation time.

Although requests is a legitimate package and no malicious dependency was found in the repository, this mutable dependency resolution prevents reproducible installation and increases supply-chain exposure. A compromised upstream release, package index, mirror, or dependency resolution path could cause unreviewed code to be installed.

Attack Path

1. A user follows the installation command in SKILL.md.
2. pip contacts the user's configured package index or mirror.
3. The index resolves a package version that was not fixed or reviewed by this project.
4. pip downloads and installs that package and its transitive dependencies.
5. Malicious package build or installation behavior, if present in the resolved supply chain, executes with the privileges of the user running pip.
6. The malicious package can subsequently execute again when the Skill imports requests.

Impact Assessment

Exploitation could execute arbitrary Python or package-installation code with the privileges of the account performing the installation. The resulting access would generally cover files, credentials, network resources, and processes available to that user. This issue does not independently provide privilege escalation beyond the privileges used to run pip, but the impact would be greater if installation were performed by an administrator or root account.

Remediation

View remediation

Remediation Suggestions

• Declare dependencies in a dedicated requirements or lock file.
• Pin requests and all transitive dependencies to versions that have been reviewed and tested.
• Record cryptographic hashes and install with hash verification, such as:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Use a trusted package index over HTTPS and avoid untrusted mirrors.
• Run dependency installation in an isolated virtual environment without administrative privileges.
• Add automated dependency vulnerability and integrity scanning to the release process.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/qsnctf_stats.py:60

Finding

Terminal Control-Sequence Injection Through Remote API Fields

Content

View full analysis

Vulnerability Details

File Location: scripts/qsnctf_stats.py:60-63 and scripts/qsnctf_stats.py:79-84
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

python

for item in items:
    username = item.get("username", "N/A")
    category = item.get("category", "N/A")
    time = item.get("time", "N/A")
    output.append(f"{username:<20} {category:<25} {time:<20}")

python

for item in items:
    grade = item.get("grade", "N/A")
    username = item.get("username", "N/A")
    score = item.get("score", "N/A")
    level = item.get("level", "N/A")
    output.append(f"{grade:<6} {username:<25} {score:<10} Lv.{level}")

Technical Analysis

Values received from the remote QSNCTF APIs are interpolated directly into terminal output without filtering control characters. Python field-width formatting affects alignment but does not remove ANSI escape sequences, OSC sequences, carriage returns, backspaces, or other terminal control characters.

If an attacker can control a displayed username, category, timestamp, ranking value, or another returned field, the attacker can cause compatible terminals to interpret embedded control sequences rather than render the content literally. HTTPS protects data in transit but does not make upstream application data safe for terminal rendering.

Attack Path

1. An attacker creates or modifies an upstream value that appears in ranking or activity data, such as a username or category.
2. The value contains terminal control characters or an ANSI/OSC escape sequence.
3. The QSNCTF API returns the crafted value in its JSON response.
4. get_answer_info() or get_ranking() accepts the value without validation.
5. format_answer_info() or format_ranking() inserts the value unchanged into the output string.
6. print() writes the crafted bytes to the user's terminal.
7. A compatible terminal interprets the se ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

• Sanitize every remote value before writing it to a terminal.
• Remove C0 and C1 control characters, particularly escape, carriage return, backspace, and OSC-related sequences.
• Apply explicit type, format, and length constraints to each field.
• Convert non-string values to safe textual representations only after validation.
• Consider rendering untrusted characters with visible escapes, such as \x1b, instead of silently removing them.
• Apply the same sanitizer to API error messages if remote messages are displayed.
• Add tests containing ANSI, OSC, newline, carriage-return, and bidirectional-control payloads to verify that output remains literal and structurally intact.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documentation instructs execution of a Python script that performs outbound network requests to external QSNCTF API endpoints, but the skill declares no explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where a runtime may permit broader network use than reviewers expect, reducing transparency and making it harder to enforce least privilege.

Content

No source excerpt is available for this finding.