作业批改与学生学业综合评估Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:46 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent homework-grading design, but its deployment guidance can expose sensitive student homework data through an under-protected OCR service.

Review before installing or using this skill in a real school environment. Treat it as a design preview, not a secure deployment guide. Pin and verify any OCR container image, bind local services to localhost or place them behind authenticated TLS, add rate limits and upload limits, and define consent, retention, deletion, audit, and access-control rules before processing student data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/ocr-implementation.md:186

Finding

Mutable and Unverified OCR Container Dependency

Content

View full analysis

Vulnerability Details

File Location: references/ocr-implementation.md, lines 186-193
Vulnerability Type: Supply-chain risk from an unpinned container image
Risk Level: Medium

Vulnerable Code

bash

# Pull the PaddleOCR Docker image
docker pull paddlepaddle/paddleocr:latest

# Start the OCR service using the CPU version
docker run -d --name paddle-ocr -p 8866:8866 \
  paddlepaddle/paddleocr:latest \
  /bin/bash -c "python3 -m paddleocr --server"

Technical Analysis

The deployment instructions retrieve and execute the mutable latest image without specifying an immutable digest or fixed, reviewed version. No signature, provenance, checksum, or software bill of materials verification is required before execution.

Because the content associated with latest can change after the Skill has been audited, administrators cannot reliably determine which code will execute. Compromise of the image publisher, registry account, build pipeline, or tag could cause a malicious image to be pulled and executed.

Attack Path

1. An attacker compromises the upstream image publication process, registry account, or mutable latest tag.
2. The attacker publishes a modified image under paddlepaddle/paddleocr:latest.
3. A school administrator follows the documented docker pull command.
4. Docker retrieves the attacker-controlled image without integrity or provenance verification.
5. The documented docker run command executes the malicious image.
6. Malicious container code accesses student submissions available to the OCR service, abuses exposed network access, or attacks accessible host and internal resources.

Impact Assessment

Successful exploitation provides code execution inside the OCR container. The resulting scope depends on the runtime configuration, attached storage, network connectivity, Docker daemon security, and container privileges.

Potential impact includes unauthorized ...[truncated 300 chars]

Remediation

View remediation

Remediation Suggestions

• Replace latest with a reviewed, fixed version and immutable SHA-256 image digest.
• Verify the image signature and publisher identity before deployment.
• Generate and review an SBOM, and scan the resolved image for known vulnerabilities.
• Establish an explicit update process that tests and approves each new image digest.
• Run the container as a dedicated non-root user.
• Use a read-only root filesystem and temporary writable volumes only where required.
• Drop all unnecessary Linux capabilities and enable no-new-privileges.
• Avoid mounting the Docker socket, host root directories, credentials, or unrelated student-data stores.
• Restrict outbound network access to destinations strictly required by the OCR workload.
• Document the expected image digest and verification commands in the deployment guide.

T09 · Insecure Skill Coding Practices

Error

• Location: references/ocr-implementation.md:190

Finding

Unauthenticated OCR Service Published Without Transport Security

Content

View full analysis

Vulnerability Details

File Location: references/ocr-implementation.md, lines 190-198
Vulnerability Type: Unauthenticated network service processing sensitive student data
Risk Level: High

Vulnerable Code

bash

# Start the OCR service using the CPU version
docker run -d --name paddle-ocr -p 8866:8866 \
  paddlepaddle/paddleocr:latest \
  /bin/bash -c "python3 -m paddleocr --server"

# Call the API
curl -X POST http://localhost:8866/ocr \
  -H "Content-Type: application/json" \
  -d '{"image": "base64_encoded_image_data"}'

Technical Analysis

Docker port publication using -p 8866:8866 normally binds the container port to all host interfaces unless the Docker daemon has been configured otherwise. The documented API uses plaintext HTTP and shows no authentication, authorization, request-size restriction, rate limiting, or network access control.

The service processes potentially identifiable work belonging to minors. Publishing the endpoint broadly can therefore expose a sensitive and computationally expensive processing interface to other devices on the local network or to external networks if routing, firewall, or cloud security-group rules permit access.

Plaintext HTTP also provides no confidentiality or server authentication when requests cross a network. An on-path attacker could observe or alter submitted images and OCR results.

Attack Path

1. An administrator starts the container using the documented port mapping.
2. Docker publishes TCP port 8866 on the host's reachable interfaces.
3. An attacker discovers the service through network scanning or prior knowledge of the documented port.
4. The attacker sends unauthenticated requests containing oversized, malformed, or numerous images.
5. The service performs attacker-controlled OCR workloads, potentially exhausting CPU, memory, disk, or worker capacity.
6. If the OCR parser or underlying image-processing libraries con ...[truncated 953 chars]

Remediation

View remediation

Remediation Suggestions

• Bind the service to loopback when only local access is required:

  bash

  docker run -d --name paddle-ocr \
    -p 127.0.0.1:8866:8866 \
    IMAGE_NAME_AT_IMMUTABLE_DIGEST
  

• For remote clients, place the OCR service behind an authenticated reverse proxy or API gateway using TLS.
• Require strong service authentication and enforce authorization based on school, class, assignment, and teacher scope.
• Place the container on a private service network and deny direct public access with host firewalls, cloud security groups, and Kubernetes network policies.
• Enforce maximum request and image sizes, accepted image formats, decoding limits, timeouts, concurrency limits, and rate limits.
• Validate uploaded content by decoded file type rather than trusting file names or request headers.
• Isolate image processing using a non-root container, read-only filesystem, dropped capabilities, resource quotas, and restricted egress.
• Avoid logging raw images, base64 image bodies, student identifiers, or full OCR responses.
• Define secure retention and deletion rules for uploaded images and temporary processing artifacts.
• Maintain security updates for OCR and image-decoding libraries and test malformed-input handling.
• Record authenticated access and administrative events without exposing sensitive payload data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly handles student homework images, OCR-extracted content, academic performance data, and role-based access to class and school-level analytics, but provides no privacy notice, retention limits, consent requirements, or data-handling safeguards. Because this involves minors' educational records and potentially identifiable images/documents, the omission increases the risk of unauthorized collection, overexposure, or noncompliant processing of sensitive student data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documentation instructs users to pull a Docker image using the mutable 'latest' tag, which makes builds non-reproducible and creates supply-chain risk if the upstream image changes or is compromised. In a school-facing OCR deployment handling student data, silently receiving a different image version could introduce vulnerable or malicious code into the grading environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/ocr-implementation.md (reported line 196)May include surrounding context.

/bin/bash -c "python3 -m paddleocr --server"

调用API

curl -X POST http://localhost:8866/ocr
-H "Content-Type: application/json"
-d '{"image": "base64_encoded_image_data"}'

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains only Chinese-language instructions and examples, and does not indicate that the skill is China-specific or that users may choose another language. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language instructions and description are entirely in Chinese and present the skill as operating for Chinese primary and secondary education contexts without stating that this locale/language is optional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all instructions and examples in Chinese, and there is no indication that users can choose another language or that the skill is intentionally restricted to a Chinese-language audience. The policy requires flagging language or locale constraints when they are imposed without user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file presents all user-facing content in a single language with no indication that users can choose another language or that the document is intended only for a Chinese-language audience. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The document is written entirely in Chinese and explicitly scopes the solution to China’s K-12 homework-grading scenario. While that may be appropriate for the target audience, the file does not state that language/locale is optional or user-selectable, which can be a natural-language locale policy concern under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file presents all guidance exclusively in Chinese and does not mention any language-selection option or intended locale scope. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue unless clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents all user-facing policy/reference content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Per the policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The title and background frame the scheme exclusively around Chinese K-12 textbooks and the 2022 compulsory education standard, but the document does not explicitly state that the skill is China-specific or limited to that locale. This can violate language/locale policy expectations if the skill is used in broader contexts without user opt-in or clear regional scoping.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.