Security audit
Security checks for vulnerabilities and agentic risk
This skill processes exams locally as advertised, with ordinary installation risks and a scoring defect that requires a separate validation step.
Prefer the reviewed local files or a verified, pinned release. Select one installation destination and back up existing customizations, since installation overwrites skill files and removes specified development remnants. Use a fresh template directory to avoid overwriting existing JSON files. Always run check with the blueprint and --gate findings=1 after assembly, then review the exam before use. Both installers and the generated-directory reference were investigated to resolve the scanner's material coverage gaps; future downloaded releases remain outside this review.
The visible commands are external package invocations, not implementations of deterministic question selection or exam validation. Their potential to download a package directly conflicts with the declared no-network operation. The package's internal behavior is not supplied, so further actions such as file modification or model invocation cannot be established from this chunk.
Although cloning a repository can be an installation step, the supplied command explicitly accesses an external resource, contradicting the stated no-network behavior. The chunk contains no exam-assembly or validation implementation, so those capabilities cannot be verified from this evidence.
The explicit npx -y commands can download and execute an external package, automatically accepting installation prompts. This materially contradicts the description's no-network and zero-dependency guarantees. The package's internal behavior is not supplied, so the snippet does not establish model calls, question generation, or other downstream actions.
The recommended installation command executes an npm package without fixing its version, allowing future package changes or a compromised release to run with the user's privileges. Although this is an installer rather than an MCP server, the supply-chain risk is real, especially because installation writes into agent skill directories; offline runtime claims do not protect installation.
The custom-directory installation example executes an unversioned npm package, so the code obtained can change without any change to this documentation. A compromised release could access local files or modify agent skills with the invoking user's permissions; the scanner's MCP terminology is inaccurate but does not eliminate that risk.
The recommended npx command executes a package selected without an exact version, exposing installation to unexpected or compromised future releases. This is not an MCP server, but the installer supply-chain concern remains significant because the command targets an agent's skills directory.
The custom-directory example runs an npm package without a pinned version, so following the same instructions later may execute different code. If a release is compromised, it runs with the user's privileges and can modify local skills; the tool's intended offline exam-processing workflow does not constrain installer execution.
Without declared permissions the skill's intent is opaque and cannot be validated.
This usage comment recommends executing an unversioned npm installer for an agent's skills directory. The comment itself does not execute anything, but following it can run a changed or compromised release with user privileges; this is a documented supply-chain weakness, not an MCP-server configuration issue.
The custom-directory usage comment directs users to run an npm installer without an exact version. Although inert as a comment, the recommendation creates supply-chain exposure when followed because a future compromised package would execute before any local installation safeguards could protect the user.
The global-install example recommends executing an unpinned npm package. This is an inert documentation example, but following it could run a compromised release and install altered skills across multiple agent directories, increasing the scope of affected agent configurations.
The default-install example runs a package whose version is not fixed, allowing its executed code to change over time. The comment does not itself fetch code, but users following it expose their local files and project agent skills to a potentially compromised installer.
Even the list-only example invokes an unpinned npm package, so package code executes before the requested listing can be trusted. The supplied implementation's list behavior is harmless, but the documentation permits a different future release to run with user privileges.
The dry-run example still executes an unversioned npm package; dry-run is an application option, not a sandbox for package execution. Although the provided implementation avoids installation writes in this mode, a compromised fetched release need not honor that behavior.
The version-query example executes a package without fixing which release is obtained. Although this is only a usage comment and the supplied version handler is benign, following the command can execute compromised code before reporting any version.
The help example invokes an unpinned npm package, and requesting help does not prevent that package from executing code. The comment is not an automatic execution path, but its recommended command exposes users to compromised future releases despite its informational purpose.
Assembly filters candidates by question type and difficulty quota but never enforces the blueprint's points_each or checks the resulting total against total_points. Consequently, a valid bank containing differently scored questions can produce an incorrectly scored paper with no findings and exit status 0, undermining the integrity of automated assembly and CI approval; the separate check command can detect this but is not invoked by assembly.
The instruction “并给出中文原因” explicitly requires Chinese-language explanations when validation fails. No user opt-in, language choice, or locale-specific justification is provided.
