T09 · Insecure Skill Coding Practices
Error
- Location
submit-quiz.js:30- Finding
Irreversible Quiz Submission Without Explicit User Confirmation
- Content
View full analysis
- Remediation
View remediation
Security audit
AP Classroom Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill openly automates AP Classroom work, but it can answer and submit live assignments from a logged-in browser without adequate final confirmation, target validation, or disclosure.
Review before installing or using. Only run this in an isolated browser profile if you fully understand that it can act as the logged-in College Board user, capture assignment screenshots, select answers, advance questions, and submit real coursework. Do not use the submission scripts unless you add explicit review and confirmation checks and verify the target page, course, and assignment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
complete-quiz.js:16- Finding
Default Automated Workflow Submits Option A for Every Question
- Content
View full analysis
{ const questionEl = document.querySelector('[class*="question"], [class*="stem"]'); return questionEl ? questionEl.textContent.trim() : ''; }); console.log(`题目: ${questionText.substring(0, 200)}...`); // 获取选项 const options = await page.evaluate(() => { const labels = Array.from(document.querySelectorAll('label')); return labels .filter(l => l.textContent.trim().length > 0) .map(l => l.textContent.trim()) .filter(t => t.length < 200); }); console.log('选项:'); options.forEach((opt, i) => { console.log(` ${String.fromCharCode(65 + i)}. ${opt}`); }); // ⚠️ 在这里添加你的答案逻辑 // 示例：选择第一个选项 const answerIndex = 0; // 使用 JavaScript 点击（避免触发划掉选项） await page.evaluate((index) => { const labels = document.querySelectorAll('label'); if (labels[index]) { labels[index].click(); } }, answerIndex); await page.waitForTimeout(2000); console.log(`✅ 已选择选项 ${String.fromCharCode(65 + answerIndex)}`); } ``` The result is then submitted by the same workflow: ```javascript while (hasNext) { // 答题 await answerQuestion(page, questionNumber); // 检查是否有 Next 按钮 const nextBtn = await page.$('button:has-text("Next")'); if (nextBtn) { console.log('🖱️ 点击 Next...'); await nextBtn.click({ force: true }); await page.waitForTimeout(5000); questionNumber++; } else { // 检查是否有 Submit 按钮 const submitBtn = await page.$('button:has-text("Submit")'); if (submitBtn) { console.log('\n✅ 所有题目已完成，准备提交'); hasNext = false; ...[truncated 2323 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
submit-quiz.js:16- Finding
Authenticated Browser Actions Use the First Open Tab and Generic Forced Selectors
- Content
View full analysis
{ const labels = document.querySelectorAll('label'); const validLabels = Array.from(labels).filter(l => { const text = l.textContent.trim(); return text.length > 0 && text.length < 200 && !text.includes('Cookie') && !text.includes('checkbox'); }); if (validLabels[index]) { validLabels[index].click(); return true; } return false; }, answerIn ...[truncated 2000 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
answer-question.js:1- Finding
Playwright Is Loaded From a Hard-Coded External Workspace Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (60)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The tool is described as completing homework across subjects, but the actual behavior appears limited to submitting an already-open page and taking screenshots before and after. In a live classroom account, undisclosed submission and screenshot actions can affect grades and capture sensitive educational information, making the mismatch security-significant.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `select-course.js` | 切换 AP 课程 | `node select-course.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `check-homework.js` | 检查待完成作业 | `node check-homework.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `get-questions.js` | 获取当前题目和选项 | `node get-questions.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `complete-quiz.js` | 完整自动化流程 | 需要编辑答题逻辑 |
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script automatically clicks Submit and then confirms submission without any user confirmation, dry-run mode, or last-minute review. In this skill's context—an AP Classroom automation that uses the currently logged-in browser to complete and submit graded work—this can irreversibly submit incorrect or unauthorized answers, causing academic harm and misuse of the user's authenticated session.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The output explicitly offers to help choose answers for an assignment, which supports academic cheating rather than legitimate accessibility or study assistance. In the context of a skill marketed to complete AP Classroom work automatically using the user’s logged-in browser, this materially increases policy, integrity, and account-enforcement risk.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The comment claims the code will only disconnect and keep the browser open, but it actually calls browser.close(). When connected over CDP to the user’s active browser session, closing the browser can terminate unrelated tabs, disrupt workflows, and cause loss of unsaved data or session state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation instructs users to launch Chrome with a remote debugging port while logged into College Board, but does not explain that this exposes powerful browser control over an authenticated session. If the port is reachable by other local users or software, an attacker or unintended tool could inspect pages, extract data, or perform actions as the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The examples explicitly walk the user through opening AP Classroom quizzes, selecting answers, and submitting them, but they do not prominently warn that this automation can act on graded coursework and cause irreversible submissions. In this skill's context, the functionality is specifically aimed at completing school assessments on a logged-in student session, which makes accidental or unauthorized grade-impacting actions materially dangerous.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file uses Chinese throughout for headings, instructions, and usage steps, but it does not indicate that Chinese is optional or that the skill is intended only for a Chinese-speaking audience. That creates a natural-language policy concern because the skill effectively forces a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly documents a workflow to open assignments, retrieve questions, select answers, and submit quizzes, but does not warn about academic-integrity violations, account sanctions, or platform terms-of-service risks. In this skill’s context, the advertised purpose is to complete AP Classroom assignments automatically using the user’s logged-in browser session, which increases the likelihood of misuse and makes the omission materially dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The release notes explicitly document capabilities to answer questions and submit AP Classroom coursework, but they do not include any warning, consent boundary, or restriction around academic-integrity and account-impacting actions. In the context of a browser-automation skill operating on a logged-in student account, this increases the risk of unauthorized submission, policy violations, and accidental changes with real academic consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill promotes automatic completion and submission of academic assignments without warning about academic-integrity violations, account sanctions, or the risks of acting on a logged-in student session. In this context, omission of such warnings increases the likelihood of misuse and unintended harm to the user's educational standing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions describe submission automation but do not clearly state that the actions affect live assignments and may be irreversible. For educational platforms, hidden or understated real-world effects are dangerous because they can lead to accidental submission, grade impact, and disciplinary consequences.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The comment claims the script will only disconnect and not affect the browser, but the code later calls browser.close(). In a CDP-attached automation context, misleading lifecycle claims can cause unintended disruption of the user's active browser session and undermine trust in what the script actually does.
- Content
Static analysis
No suspicious patterns detected.