T09 · Insecure Skill Coding Practices
Error
- Location
scripts/verify-answer.py:42- Finding
Unsafe SymPy Expression Parsing in Answer Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Vietnam Education
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate Vietnamese education helper, but it needs Review because its setup and math-expression workflows can affect the local environment and may execute unsafe input.
Install only in an isolated project environment or container. Avoid the documented global npm install and --break-system-packages pip command; use pinned dependencies and a virtual environment instead. Do not pass formulas or graph expressions from untrusted prompts directly into the scripts, and confirm before web searching private exams, teacher materials, or student-related context.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/draw-figure.py:101- Finding
Unsafe SymPy Expression Parsing in Graph Rendering
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:56- Finding
Unpinned Global and System Python Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
There is a material description-behavior mismatch. While one part of the declared purpose mentions a script that creates .docx exam files in CV 7991 format, the overall description presents a much broader skill: generating giáo án/kế hoạch bài dạy/phiếu học tập and exam materials across all grade levels and subjects, with a three-layer verification system involving web search, SymPy, and Matplotlib. The actual code only implements local document generation for a predefined Grade 10 Math exam set. It contains hardcoded topics, questions, and answers, and outputs three .docx files with formatting and pagination. This partially matches the narrow claim about a .docx exam-generation script, but it does not implement the major advertised capabilities, especially verification, plotting, broad subject coverage, or lesson/worksheet generation. Therefore the description significantly overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a broad pedagogical authoring and verification skill with multiple major capabilities: creating educational documents, verifying answers via web/SymPy, and producing formatted .docx exam files. The supplied code chunk only implements one narrow subset: drawing figures and charts with matplotlib, plus parsing a math expression for graph plotting. While Matplotlib-based figure drawing is mentioned in the description, this chunk alone does not substantiate the skill’s primary declared purpose. Therefore the description materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
There is a clear description-behavior mismatch. The description presents a comprehensive curriculum-aligned educational authoring skill with multiple verification layers and document-generation features across all school levels. The actual code chunk is much narrower: a local command-line verifier focused on symbolic math/calculation tasks, basic geometry formulas, and limited chemistry equation balancing. The script does not access the web, does not render plots, does not create Word documents, and does not produce lesson plans, tests, or worksheets. While the SymPy-based verification aspect partially matches the declared VERIFY layer, the primary declared purpose and several major capabilities are absent from this code.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Script `scripts/create-exam.js` tạo file .docx hoàn chỉnh, chuẩn format CV 7991.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Script `scripts/create-exam.js` tạo file .docx hoàn chỉnh, chuẩn format CV 7991.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are extremely broad and likely to match ordinary educational conversations, which can cause the skill to activate unexpectedly. In agent environments, overbroad activation increases the chance of unintended tool use, file generation, package-install guidance, or external lookups when the user did not explicitly request this skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill mandates web searches for all subjects without warning that user-provided prompts, exam questions, or curricular content may be sent to third-party services. In educational settings this can expose proprietary teacher materials, unpublished exams, or student-related context to external systems without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains natural-language instructions and operational output entirely in Vietnamese, beginning in the top-level docstring and continuing throughout the script. Because the skill forces a specific language for usage instructions rather than offering a locale choice or documenting a justified locale restriction, it violates the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s natural-language docstring and usage/help text are entirely in Vietnamese, and there is no indication that the skill is region-specific or that users may select another language. This can violate language/locale policy when the skill is used in broader contexts because it imposes a language constraint without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The argparse description, argument help strings, dependency message, and completion message are all presented only in Vietnamese. Because no language selection or locale justification is provided, the skill effectively forces a specific language on all users.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring claims support for physics verification and chemical balancing, including examples like
--physics, but the command-line interface never defines a--physicsoption and chemistry handling is only a hardcoded lookup table rather than general verification. This creates a meaningful mismatch between the documented capability and what users can actually do with the script.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The usage examples explicitly tell users to invoke
--exprand--physics, but the argument parser only defines--equation,--calc,--quadratic,--geometry,--params, and--chem. This is an active contradiction between the script's documentation and its actual interface, not merely omitted detail.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill promotes one-command .docx generation but does not clearly disclose that it writes files to disk. Hidden or insufficiently disclosed file writes can surprise users, overwrite files, or create artifacts in sensitive working directories, especially in automated agent contexts.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file is natural-language guidance, and all user-facing content is presented only in Vietnamese. Under the policy-violation category, forcing a specific language without user opt-in can be a locale policy issue when no language choice or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language policy issues apply to all file types, including code comments, docstrings, and user-facing strings. This file presents its purpose and usage entirely in Vietnamese, and later CLI descriptions are also Vietnamese-only, with no opt-in or indication that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The parser description and help strings are user-facing natural language, and they require Vietnamese comprehension to use the script effectively. Because no language choice or locale justification is provided, this is a language/locale policy concern under SQP-3.
- Content
Static analysis
No suspicious patterns detected.