Caveat verdict
quiz-maker
Quiz generation skill that extracts document content locally, calls a cloud API with user-provided ARK_API_KEY, and generates a QR code locally; executionSinkDetected reflects documented bash commands for document parsing, all consistent with stated purpose.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (11)
Pipe to python — executes piped content as Python code
SKILL.md · code · | python3
Pipe-to-shell pattern (curl | sh) — supply chain attack vector
deploy/deploy.sh · prose · downgraded · curl -fsSL https://deb.nodesource.com/setup_20.x | bash
Pipe to bash — executes piped content as shell commands
deploy/deploy.sh · prose · downgraded · | bash
Uses exec() — may execute shell commands
db.js · prose · downgraded · exec(
apt-get install — installs system packages
deploy/deploy.sh · prose · downgraded · apt-get install
References child_process — can spawn system processes
parser.js · prose · downgraded · child_process
Long base64 string (100+ chars) — likely obfuscated payload
public/qrcode.min.js · prose · downgraded · iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHx
subprocess execution — runs system commands from Python
qr-gen.py · prose · downgraded · subprocess.run(
HTTP request to bare IP address — common in malicious payloads
server.js · prose · downgraded · https://118.196.5.240
Node http/https module — low-level network access
question_generator.js · prose · downgraded · require('https')
Accesses sensitive environment variables
question_generator.js · prose · downgraded · process.env.ARK_API_KEY
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class A/D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.