Security audit

exam-question-generator

Security checks for vulnerabilities and agentic risk

Overview

This exam-question skill is mostly purpose-aligned, but it needs review because it generates executable HTML from unescaped content and loads third-party scripts.

Review before installing. Use it only in workspaces where generated exam files are non-sensitive, and avoid feeding it untrusted notes or knowledge-map values until the HTML renderer escapes or sanitizes all inserted text. Prefer explicit invocation phrases and confirm before reruns that overwrite outputs. Generated HTML should either bundle trusted local assets or use integrity-protected CDN resources.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: assets/template.html:286
Finding: Mandatory Promotional Branding Hijacks Generated Output
Content: View full analysis
天禧 AI Claw · 考前冲刺 ``` ### Technical Analysis The HTML template contains a fixed promotional attribution that is unrelated to the functional purpose of generating examination questions. The instructions in `SKILL.md` require the agent to read and use this template rather than construct an alternative document. Consequently, every generated artifact inherits the hard-coded branding without disclosure, user consent, or a configuration option to remove it. This creates deterministic output hijacking: loading and following the skill changes the content of the user's requested artifact by inserting attacker-selected promotional material. ### Attack Path 1. A user invokes the examination-question-generation skill. 2. The skill requires the agent to load `assets/template.html`. 3. The agent replaces the documented placeholders but leaves the fixed footer unchanged. 4. The generated examination page includes the promotional attribution. 5. The user receives or distributes an artifact containing unsolicited branding and potentially misleading attribution. ### Impact Assessment The issue does not grant operating-system privileges, filesystem access, or code execution. Its scope is manipulation of every HTML artifact generated through the skill. It can result in unsolicited advertising, reputational harm, misleading content attribution, and loss of user control over generated output. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:156
Finding: Unescaped Data Is Interpolated into Executable HTML
Content: View full analysis

{题号}
{类型中文：单选/多选/判断/简答} {score}分 {source_point_name}

{content}

A. {选项}

B. {选项}

C. {选项}

D. {选项}

查看答案 ▼

答案：{answer}

{explanation}
考点：{source_point_name}
``` The corresponding template consumes generated HTML and other untrusted values directly: ```html

📚 {{exam_type}}

⏳ 距考 {{days_remaining}} 天

🎯 {{target_score}}

{{set1_questions}}

{{set2_questions}}

{{set3_questions}}

``` ### Technical Analysis Fields such as `exam_type`, `target_score`, `content`, `options`, `explanation`, and `source_point_name` can originate from `knowledge_map.json`, retrieved knowledge-base notes, or model-generated content. The documented rendering process performs direct string substitution and does not require contextual HTML escaping or sanitization. ...[truncated 1962 chars]
Remediation: View remediation
`, `"`, and `'` when values are placed in HTML text or attribute contexts. - Do not allow retrieved notes or generated model output to supply raw HTML. - If limited formatting is required, sanitize it with a mature allowlist-based HTML sanitizer. Permit only necessary formatting elements and remove scripts, event-handler attributes, frames, forms, styles, dangerous URL schemes, and active embedded content. - Prefer constructing question cards using DOM APIs and assigning untrusted content through `textContent` rather than using string concatenation or `innerHTML`. - Validate constrained fields such as question type, score, answer format, and point identifiers against strict schemas and allowlists. - Add regression tests using payloads in every rendered field, including tag-breaking input, event handlers, SVG payloads, encoded markup, and dangerous links. - Consider deploying generated pages with a restrictive Content Security Policy that blocks inline scripts and unauthorized network destinations. This should be defense in depth and must not replace escaping and sanitization. ]]>

T08 · Insecure Dependencies

Warning

Location: assets/template.html:7
Finding: Externally Hosted JavaScript Is Loaded Without Subresource Integrity
Content: View full analysis
``` ### Technical Analysis The generated HTML loads JavaScript from a third-party content delivery network. Although the dependency version is pinned, the script elements do not include Subresource Integrity hashes. The browser therefore trusts and executes whatever content the external endpoint returns for those URLs. If the CDN, package distribution account, DNS path, or delivery infrastructure is compromised, the effective JavaScript payload can change after the skill package has been audited. The generated document also requires network access when opened, unnecessarily expanding its runtime trust boundary. ### Attack Path 1. A user generates an examination HTML file from the template. 2. The user opens the generated file while connected to the network. 3. The browser requests the KaTeX scripts from the configured CDN. 4. A compromised dependency-distribution path returns modified JavaScript. 5. Because no integrity hash is present, the browser accepts and executes the modified response. 6. The malicious dependency runs in the generated document's context and can inspect or alter its contents and issue network requests. ### Impact Assessment A compromised external script can execute arbitrary JavaScript within the generated page, modify examination material, capture interactions, and exfiltrate page-accessible information. It does not dire ...[truncated 177 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases 继续 and 重新出题 are broad conversational terms that can be said in many contexts, making accidental skill invocation likely. Because this skill reads files, invokes another skill, and writes/overwrites JSON and HTML in the workspace, an unintended trigger can cause unanticipated side effects and file changes without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill behavior includes writing .exam-session/questions.json, generating an HTML file, and overwriting old output on 重新出题, but the description does not warn users about these persistent workspace modifications. This lack of disclosure weakens informed consent and makes accidental data loss or confusing file-state changes more likely, especially when combined with the broad trigger phrases.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill's main flow and output-format sections state the final HTML should be written to the workspace root as exam-questions-YYYYMMDD.html (L032, L138). However, the Anti-Patterns section says the final artifact must be .exam-output/exam-questions-YYYYMMDD.html, which is a different path and directly conflicts with the rest of the document.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The follow-up triggers for launching the next skill include highly generic replies like 要, 好, 继续, and 是, which are common in normal conversation and can chain-execute another skill without clear consent. In this context, such broad intent matching increases the risk of unintended workflow progression, extra file generation, and confusing automation cascades across skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML root element hard-codes lang="zh-CN", which makes the template explicitly Chinese-language/localized by default. Under the stated policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file defines the question format entirely in Chinese and hard-codes answer values such as "正确" and "错误". Because it does not provide any user opt-in, locale choice, or justification for a Chinese-only constraint, it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.