Security audit

Banjixiaoguanjia

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real homework automation skill, but it needs careful review because it can upload identifiable student work to external AI services and handles credentials unsafely.

Install only if you are authorized to process and upload student homework through DashScope/Qwen or similar external AI services. Treat the included API keys as compromised, use your own properly scoped credentials, review school/parent consent and data-retention requirements, and run only the documented current scripts after checking where screenshots, originals, and reports will be stored.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (120)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The description frames the skill as a screenshot tool, but the body also describes downloading originals, AI grading, and generating TXT/Word reports. This is a real security and privacy issue because users may authorize or run the skill under a narrower assumption than its actual data-processing scope.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Using shell-based curl downloads introduces command-execution risk and broadens the attack surface unnecessarily for a skill described as taking screenshots. Even if the immediate example quotes parameters, shell invocation with externally derived URLs and paths is risky and enables uncontrolled outbound transfers of potentially sensitive student content.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Reading an API key from the environment to upload homework images to an external AI provider exceeds the stated screenshotting purpose and creates a privacy-sensitive external data flow. Because the content involves children's homework and authenticated class data, sending images to third parties without strong disclosure and controls is particularly sensitive.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Generating grading reports and documents is materially different from simple screenshot capture and can create additional persistent records containing student performance data. The extra processing and storage increase privacy risk, especially when the skill targets elementary school homework.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is described as a homework screenshot tool, but the implementation also performs remote AI-based analysis and report generation on student homework images. This creates a material mismatch between declared functionality and actual data handling, increasing the risk of undisclosed transmission of minors' educational data to a third party.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code hardcodes an API key and uses it to send student homework images to an external cloud model endpoint. Hardcoded credentials are easily leaked through source distribution, and transmitting student data—especially data associated with named students—to a third party without clear justification or consent creates a serious privacy and compliance risk.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This script goes beyond the advertised screenshot-capture purpose by uploading student homework screenshots to a third-party AI endpoint and persisting derived results locally. Because the images likely contain minors' educational data, this creates a significant privacy and compliance risk, especially when the capability is not clearly disclosed or constrained.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code base64-encodes each student screenshot and sends it to DashScope for model analysis, which is a direct transfer of potentially sensitive student data to an external service. In a tool marketed as a homework screenshot utility for primary-school teachers, this hidden data-sharing capability materially increases privacy, legal, and trust risk.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The script goes beyond local screenshot capture and performs external AI analysis of student homework screenshots, which likely contain minors' personal data and educational records. In this skill context, transmitting such data to a third-party model endpoint materially increases privacy, compliance, and data-governance risk because the manifested purpose is batch screenshot capture for teachers, not off-platform student-data processing.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The script imports execSync and later generates and runs Python code dynamically to process screenshots. Spawning a subprocess with generated code expands the attack surface, complicates auditing, and introduces avoidable risks around secret handling and unsafe file/content interpolation, especially in a teacher-facing automation tool that should be simpler and more constrained.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script reads DASHSCOPE_API_KEY and uses it to send student screenshots to an external AI endpoint. In this context, the data appears to be homework screenshots associated with student names, so exporting it to a third party without strong necessity or explicit scope justification creates a significant privacy and compliance exposure.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script uploads student homework images and grading prompts to a third-party Qwen service for remote inference, which materially exceeds the stated browser-automation and screenshotting purpose of the skill. Because the data concerns children’s homework and educational performance, this creates a significant privacy and compliance risk through unauthorized external data transfer.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This code sends student images to an external model endpoint without necessity for the declared screenshot function, introducing unjustified third-party processing of sensitive student content. In a school/child context, such exfiltration can expose personally identifiable educational data and create regulatory and reputational harm if the service is compromised, misconfigured, or used without authorization.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The script dynamically generates Python code and executes it via a subprocess, which expands the execution surface beyond simple screenshot capture and makes behavior harder to audit and constrain. While this instance does not directly execute untrusted user input as shell commands, it still introduces avoidable complexity, dependency risk, and opportunities for misuse or tampering on the local system.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code embeds a fallback API key directly in source while also reading credentials from the environment, which is a serious secret-management failure. Hardcoded credentials can be leaked through source sharing, backups, logs, or repository history, enabling unauthorized use of the external service and potential billing abuse or broader account compromise.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill metadata says it is a screenshot automation tool, but the code also performs AI analysis of captured student homework images and generates a report with named student results. This expands the data-processing scope from simple capture to secondary processing of minors' educational data without clear disclosure, increasing privacy and compliance risk.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The script launches an external Python process to analyze screenshots, which introduces a powerful execution boundary not implied by the stated screenshot-only purpose. Invoking subprocesses on sensitive student images increases the attack surface, can leak data to unreviewed components, and creates command-execution risk if paths or arguments become attacker-controlled.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code reaches into another local skill workspace under the user's profile and executes a script from there, creating an implicit trust dependency on external mutable code. If that other skill is modified, replaced, or malicious, this skill will execute it on sensitive homework screenshots, enabling arbitrary local code execution and data exfiltration.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill’s stated purpose is batch screenshot capture for homework review, but this code goes further by aggregating and analyzing student screenshots with an external AI workflow. That expands processing of likely minors’ educational data beyond the declared purpose, creating an undisclosed data-use and privacy risk even if the analysis goal is operationally related.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code base64-encodes student homework screenshots and sends them to a third-party cloud AI endpoint, which is a direct external transmission of potentially sensitive student data. In the context of a tool for elementary school teachers, this is especially dangerous because it may expose minors’ educational records and names to an external processor without explicit notice, consent, or data-minimization controls.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The script launches a local Chrome process with remote debugging enabled via child_process.spawn, which is an elevated automation capability not obvious from a simple screenshot tool description. While likely intended for convenience, opening a debugging port and spawning a browser can expand the attack surface and affect the user’s local environment in ways they may not expect.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script unconditionally deletes the entire output directory with recursive removal before starting, which can destroy unrelated files if the path is misconfigured, hardcoded incorrectly, or influenced by user input in future reuse. In this skill context, the hardcoded desktop path and teacher-facing automation make accidental data loss more plausible because the operator may run it on a machine containing other personal or school files.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a screenshot automation tool, but the code also performs AI-based image analysis and writes derived analysis files. This materially expands the data-processing scope beyond the stated purpose, which is dangerous because operators may run it without realizing student homework images are being interpreted and persisted as structured results.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code base64-encodes screenshots of student homework and sends them to an external DashScope-compatible AI API for analysis. This is a real privacy and data-exfiltration issue because sensitive student work leaves the local machine and is transmitted to a third party without any explicit consent, minimization, or visible approval step.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The script writes a temporary Python program containing embedded API credentials context and image data, then executes it as a subprocess. While not automatically malicious, this exceeds the expected browser-automation scope and increases attack surface through cross-runtime execution, temporary sensitive artifacts, and dependence on an external interpreter.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: analyze-homework.js:88

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/analyze-homework-ai.js:100

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/analyze-screenshots.js:100

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/analyze-with-qwen.js:119

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/capture-and-analyze-36.js:386

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/capture-auto-start.js:53

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/capture-auto.js:45

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/complete-workflow.js:95

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/convert-to-word.js:94

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/download-37.js:47

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/download-student-fixed-20260322.js:154

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: archived-scripts/index.js:474

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: capture-36-fixed.js:338

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: download-homework.js:375

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: archived-scripts/capture-auto-start.js:431

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: archived-scripts/capture-auto.js:261

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: capture-new-browser.js:16

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: archived-scripts/example-full.js:13