Security audit

Yq Knowledge Digest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent study-material generator, with a notable caution that generated quiz HTML should be handled carefully when built from untrusted content.

Before installing, be aware that the skill may generate local files and may use web search if you choose that path for a topic without source material. Treat quiz HTML made from untrusted documents or web material as untrusted unless the generated content is escaped or sanitized, especially before hosting it on any authenticated site.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:400
Finding: Unsafe HTML Injection in Generated Quiz Feedback
Content: View full analysis
✓ 正确'; correct++; } else { feedback.innerHTML = '✗ 错误正确答案：' + answer + '
' + explanations[qName] + '
'; } ``` ### Technical Analysis The quiz-generation template assigns dynamically generated values to the `innerHTML` property. In particular, `explanations[qName]` may be derived from user-provided or externally searched educational material. The skill does not require this content to be escaped or sanitized before interpolation into the HTML string. Because `innerHTML` parses its assigned value as markup, an attacker-controlled explanation containing HTML elements or executable event handlers could be interpreted by the browser rather than displayed as plain text. The generated explanation data may also create an injection issue earlier if it is embedded in a JavaScript object without safe serialization. The hard-coded markup itself is not dangerous. The vulnerability arises from concatenating potentially untrusted generated content into that markup without defining a trust boundary or sanitization requirement. ### Attack Path 1. An attacker supplies a textbook, document, or other learning material containing a crafted payload. 2. The skill extracts or transforms the malicious content into a quiz explanation. 3. The payload is placed in `explanations[qName]` in the generated quiz HTML. 4. A user opens the generated quiz in a web browser. 5. The user submits an incorrect answer, causing the vulnerable branch to execute. 6. The browser assigns the explanation to `feedback.innerHTML` and parses the ...[truncated 921 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger words are broad enough to match ordinary educational requests, which can cause the skill to activate unexpectedly outside a clearly consented context. That increases the chance the agent will initiate complex file generation or web-search behavior when the user only intended a general discussion, creating unnecessary data exposure and tool use risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow allows the skill to search the web for source material when the user has not uploaded documents, but the top-level description does not clearly disclose that external retrieval may occur. Users may unknowingly trigger browsing and incorporation of third-party content, which creates consent, privacy, and content-integrity risks, especially if the topic is sensitive or the retrieved material is unreliable.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.