软考高级真题与模拟题

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:13 AM UTC
• Version: 3.1.0

Overview

This skill has a coherent exam-prep purpose, but it asks for broad command execution and remote content retrieval without enough safeguards.

Install only if you are comfortable with a skill that can run local gh commands and fetch mutable third-party exam Markdown. A safer version would remove exec, use structured GitHub or web fetches, narrow activation phrases to Ruankao-specific requests, and explicitly ignore instructions embedded in fetched content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:64

Finding

Shell Command Injection Through Unvalidated Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:64-80; references/sources.md:76-89
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

SKILL.md:64-80:

bash

# List all years for a subject
gh api "repos/wujiaming88/awesome-ruankao/contents/真题/{科目名}" --jq '.[].name'

# Obtain the file list for a year
gh api "repos/wujiaming88/awesome-ruankao/contents/真题/{科目名}/{年份目录}" --jq '.[].name'

# Obtain the file download URL
gh api "repos/wujiaming88/awesome-ruankao/contents/真题/{科目名}/{年份目录}/综合知识.md" --jq '.download_url'

# List mock-examination directories
gh api "repos/wujiaming88/awesome-ruankao/contents/模拟题/系统架构设计师/2026年5月" --jq '.[].name'

# Obtain mock-examination content
gh api "repos/wujiaming88/awesome-ruankao/contents/模拟题/系统架构设计师/2026年5月/模拟卷{N}/综合知识_题目.md" --jq '.download_url'

references/sources.md:76-89:

bash

gh api "repos/wujiaming88/awesome-ruankao/contents/真题" --jq '.[].name'

gh api "repos/wujiaming88/awesome-ruankao/contents/真题/系统架构设计师" --jq '.[].name'

gh api "repos/wujiaming88/awesome-ruankao/contents/真题/系统架构设计师/2024年下半年/综合知识.md" --jq '.download_url'

gh api "repos/wujiaming88/awesome-ruankao/contents/模拟题/系统架构设计师/2026年5月" --jq '.[].name'

gh api "repos/wujiaming88/awesome-ruankao/contents/模拟题/系统架构设计师/2026年5月/模拟卷3/综合知识_题目.md" --jq '.download_url'

Technical Analysis

The Skill declares access to the exec tool and directs the agent to construct shell commands by substituting subject names, year-directory values, and mock-examination numbers into command strings. Although the variable fields appear inside double quotes, double quotes do not disable shell command substitution, including constructs such as $(command) and backticks.

The instructions do not require the agent to map input to immutable constants, validate it against an exact allowlist, reject shell metacharacters, or invoke gh without a shell. Consequently, an agent t ...[truncated 1503 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the exec capability and use a structured GitHub API or HTTP client whose URL and query components are passed as data rather than shell text.
2. Map supported subjects to fixed internal repository paths. Never use the original user-provided subject string in a command.
3. Parse years as integers and enforce an explicit supported range. Map semester values to fixed constants.
4. Parse mock-examination numbers as integers and accept only the documented range of 1 through 5.
5. If process execution is unavoidable, invoke gh through an argument-array API without a shell, equivalent to shell=false.
6. Reject parameters containing control characters, path separators outside the expected format, shell metacharacters, command substitutions, or traversal sequences.
7. Add negative tests using values containing $(), backticks, quotes, semicolons, newlines, and path traversal components.
8. Apply the same hardened examples in both SKILL.md and references/sources.md so that the reference document cannot reintroduce unsafe execution patterns.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:59

Finding

Untrusted Mutable Remote Markdown Is Treated as Verified Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-71,177; references/sources.md:5-15,82-83
Vulnerability Type: Indirect prompt injection through a mutable remote content source
Risk Level: Medium

Vulnerable Code

SKILL.md:59-71:

markdown

**wujiaming88/awesome-ruankao** (GitHub)（内容已验证，纯 Markdown 可直接读取）：

#### 真题检索
```bash
gh api "repos/wujiaming88/awesome-ruankao/contents/真题/{科目名}" --jq '.[].name'

gh api "repos/wujiaming88/awesome-ruankao/contents/真题/{科目名}/{年份目录}" --jq '.[].name'

gh api "repos/wujiaming88/awesome-ruankao/contents/真题/{科目名}/{年份目录}/综合知识.md" --jq '.download_url'
# 然后 web_fetch 该URL获取Markdown内容

text

`SKILL.md:177`:

```markdown
- 本地资料库内容已验证，优先使用

references/sources.md:5-15:

markdown

1. **wujiaming88/awesome-ruankao** (GitHub)（唯一主数据源）
2. **Web搜索兜底**（仓库中找不到时）

## 源: wujiaming88/awesome-ruankao (GitHub)

- **API**: `gh api repos/wujiaming88/awesome-ruankao/contents/{path}`
- **分支**: `main`
- **覆盖**: 5个高级科目，2020-2025年，166个文件，9MB
- **特点**: 内容已验证、纯Markdown可直接web_fetch、含完整答案解析、含模拟题

references/sources.md:82-83:

bash

gh api "repos/wujiaming88/awesome-ruankao/contents/真题/系统架构设计师/2024年下半年/综合知识.md" --jq '.download_url'
# 然后 web_fetch 该URL

Technical Analysis

The Skill designates a third-party GitHub repository as its primary source, uses the mutable main branch, retrieves a download URL, and supplies the resulting Markdown to the agent. It repeatedly describes that content as verified, but it does not pin an audited commit, verify a cryptographic digest, restrict redirects and final download hosts, or instruct the agent to treat instructions embedded in fetched documents as untrusted data.

Markdown is not executable code by itself. However, when it is placed into an agent's context, attacker-written directives can become indirect prompt-injection material. If the repository owner account, repository, branch, or upstream con ...[truncated 1807 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a specific audited commit SHA instead of reading from the mutable main branch.
2. Maintain a manifest of approved paths and cryptographic hashes, and reject content that does not match it.
3. Explicitly state that all fetched repository and web-search content is untrusted data. The agent must never follow instructions, tool requests, policy statements, or role changes found inside that content.
4. Permit download URLs only from the expected GitHub API and raw-content hosts, require HTTPS, disable or validate redirects, and verify the repository and commit encoded by the resolved URL.
5. Parse and extract only the expected question, option, answer, and explanation sections before adding content to the response context.
6. Quote or delimit remote material and label it as external source data.
7. Apply stricter handling to web-search fallback results because they are not controlled by the designated repository.
8. Replace unconditional claims that the source is “verified” with a precise statement describing the pinned revision, verification date, and integrity controls.
9. Use least-privilege tool permissions while processing remote content, especially by disabling exec for content retrieval.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language description and trigger phrases are entirely Chinese-focused, and the file does not state that the skill is region- or language-specific or offer an opt-in language choice. Under the stated policy, forcing a specific language without user choice can be a locale-policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list contains broad phrases such as '历年真题', '刷题', and '模拟题' that are common in ordinary educational conversations and may cause the skill to activate when the user did not specifically intend to invoke it. Because this skill has access to exec, web_search, web_fetch, and read, unintended invocation can expand tool use and expose the agent to unnecessary external content retrieval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill reference is written only in Chinese and all examples, labels, and subject taxonomy assume a Chinese-language workflow. Under the policy, language constraints should either offer user choice or be clearly documented as a justified region-specific limitation; this file does not explicitly state such a limitation or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.