Adaptive Testing

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:39 PM UTC
• Version: 1.0.3

Overview

This skill is mostly educational, but its implementation guidance includes insecure production-style API patterns for test scoring and session control.

Install only if you treat it as conceptual psychometrics guidance. Do not copy the API example into production without adding authenticated users, session ownership checks, server-side answer scoring against protected answer keys, current-question enforcement, replay protection, and tests for forged submissions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/implementation.md:243

Finding

Client-Controlled Test Scoring and Unvalidated Item Submission

Content

View full analysis

Vulnerability Details

File Location: references/implementation.md, lines 243–246 and 274–283
Vulnerability Type: Client-controlled scoring and missing test-flow validation
Risk Level: High

Vulnerable Code

python

class SubmitAnswerRequest(BaseModel):
    session_id: str
    item_id: int
    response: bool  # True = correct, False = incorrect

@app.post("/api/test/answer")
async def submit_answer(req: SubmitAnswerRequest):
    # Load session
    session = get_session(req.session_id)
    engine = session.engine

    # Get item
    item = get_item(req.item_id)

    # Process response
    engine.administer_item(item, req.response)

Technical Analysis

The API accepts a client-provided Boolean indicating whether an answer is correct. This makes the client authoritative for scoring: a malicious test taker can submit response: true without knowing the correct answer.

The endpoint also retrieves an arbitrary client-supplied item_id without verifying that the item was issued as the session's current question. No check prevents submitting an unassigned item, submitting the same item repeatedly, or submitting an item after it has already been answered.

These flaws violate the principle that security-sensitive decisions must be made on the trusted server side. The server should receive an answer choice, validate it against a protected answer key, and enforce the assessment's state transition rules.

Attack Path

1. The attacker starts or obtains a valid test session.
2. The attacker calls /api/test/answer with the session identifier and an arbitrary item ID.
3. The attacker sets response to true, regardless of the actual answer.
4. The attacker repeats forged submissions until the stopping rule is reached.
5. The system calculates and returns an artificially elevated ability estimate.
6. Depending on how results are consumed, the attacker may obtain an improper placement, passing result, or certification outcome.

Impact

...[truncated 491 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the client-provided correctness Boolean with a submitted answer value or answer-choice identifier.
• Score the submitted answer exclusively on the server against a protected answer key.
• Store the currently issued item in trusted session state.
• Verify that item_id matches the current unanswered item assigned to the session.
• Reject duplicate, skipped, stale, out-of-order, or post-completion submissions.
• Use an atomic state transition or database transaction to prevent concurrent duplicate submissions.
• Validate that every submitted item belongs to the session's configured test and item bank.
• Avoid returning answer keys or correctness metadata in serialized item responses.
• Add tests covering forged correctness values, arbitrary item IDs, replayed submissions, and concurrent requests.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/implementation.md:239

Finding

Missing Authentication and Object-Level Authorization for Test Sessions

Content

View full analysis

Vulnerability Details

File Location: references/implementation.md, lines 239–245 and 274–280
Vulnerability Type: Missing session ownership authorization
Risk Level: Medium

Vulnerable Code

python

class StartTestRequest(BaseModel):
    student_id: str
    test_type: str

class SubmitAnswerRequest(BaseModel):
    session_id: str
    item_id: int
    response: bool  # True = correct, False = incorrect

@app.post("/api/test/answer")
async def submit_answer(req: SubmitAnswerRequest):
    # Load session
    session = get_session(req.session_id)
    engine = session.engine

    # Get item
    item = get_item(req.item_id)

Technical Analysis

The example accepts student_id and session_id directly from the client but shows no authentication or object-level authorization. The answer endpoint loads and mutates a session solely by its supplied identifier. It does not verify that the authenticated caller owns the session or is authorized to administer it.

Consequently, possession of another user's session identifier may be sufficient to access and alter that user's assessment state. Session identifiers can be exposed through logs, browser history, analytics, referrers, insecure clients, or predictable identifier generation.

The deployment checklist mentions rate limiting, but rate limiting does not replace authentication, session ownership checks, expiration controls, or authorization.

Attack Path

1. The attacker obtains or guesses another student's session identifier.
2. The attacker submits a request to /api/test/answer using the victim's session_id.
3. Because the endpoint performs no demonstrated ownership check, it retrieves the victim's session.
4. The attacker submits forged answers or arbitrary item IDs.
5. The victim's ability estimate, response history, and session progress are modified.
6. The attacker may repeat the process until the session is completed or its result is materially altered.

Impact Assessment

...[truncated 528 chars]

Remediation

View remediation

Remediation Suggestions

• Require authentication for all test start, answer submission, status, and result endpoints.
• Derive the student identity from the authenticated principal rather than trusting a request-body student_id.
• Enforce object-level authorization on every session request by verifying that the authenticated principal owns or is explicitly authorized to administer the session.
• Generate session identifiers with a cryptographically secure random source and sufficient entropy.
• Expire sessions after a defined period and reject requests for completed, revoked, or expired sessions.
• Store session identifiers in secure transport and storage contexts; require HTTPS and avoid exposing identifiers in URLs or logs.
• Return generic not-found or forbidden responses that do not disclose whether another user's session exists.
• Add rate limits and monitoring for repeated invalid session identifiers, while treating these as supplemental controls rather than authorization.
• Add automated tests proving that one authenticated user cannot read or mutate another user's session.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.