深圳大学校园事务 CLI

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 0.2.1

Overview

This skill guides an agent to use a campus CLI for sensitive Shenzhen University account tasks, with clear privacy limits and confirmation rules for state-changing actions.

Install only if you trust the szu-cli package and publisher. Prefer reviewing or pinning the exact szu-cli version before global installation, avoid chained install-and-run commands when possible, and use the skill only for campus tasks you intentionally request because it can access private academic and account data through your authenticated session.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Global Installation of a Privileged External CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-24
Additional Location: README.md:7-17
Vulnerability Type: Unpinned third-party dependency installed globally and executed with access to sensitive campus services
Risk Level: Medium

Vulnerable Code

From SKILL.md:20-24:

bash

npm install -g szu-cli

From README.md:7-17:

bash

npm install -g szu-cli && szu-cli skill install --target codex --json

bash

szu-cli skill install --target codex --json

Technical Analysis

The project delegates its operational behavior to the external szu-cli npm package, but the documented installation commands do not pin an exact reviewed version or verify package integrity or provenance. Consequently, installation resolves whichever version the npm registry serves at that time.

A global npm installation can run package lifecycle scripts with the privileges of the invoking user. The chained README command also executes the newly installed CLI immediately after installation. Because the audited project does not contain the CLI implementation, its lifecycle scripts, authentication storage, network behavior, and command implementations could not be verified in this audit.

This CLI is subsequently trusted to use a persistent authenticated browser profile and access sensitive campus records and state-changing services. The issue is therefore a supply-chain trust weakness rather than evidence that the currently published package is malicious.

Attack Path

1. An attacker compromises the szu-cli npm publisher account, release pipeline, dependency graph, or package-distribution channel.
2. The attacker publishes or causes resolution of a malicious package version.
3. A user follows the documentation and runs npm install -g szu-cli without an exact version or integrity verification.
4. Malicious lifecycle code may execute during installation under the user's local account.
5. In the README's chained command, the unverified C ...[truncated 1009 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to an exact, reviewed szu-cli version rather than resolving the latest mutable release:

   bash

   npm install -g szu-cli@X.Y.Z
   

2. Publish the expected package integrity digest and provide a documented verification procedure before installation.

3. Enable and document npm package provenance, signed releases, protected publisher accounts, and a verifiable link to the canonical source repository.

4. Avoid chaining installation and immediate execution. Separate installation, integrity verification, and execution into distinct steps.

5. Prefer a project-local or isolated installation over a global installation where practical, reducing the writable and executable scope.

6. Audit the exact CLI release, including lifecycle scripts, transitive dependencies, browser-profile handling, update behavior, network destinations, and state-changing commands.

7. Keep the existing minimum-version compatibility check, but supplement it with an approved-version policy or reviewed version range; a lower bound alone does not prevent installation of a compromised future release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep