Security audit

Tmp.UujTw67gf4

Security checks across malware telemetry and agentic risk

Overview

This skill is a transparent curl-based guide for accessing a parent portal, but it handles sensitive student records and live session cookies that users must protect carefully.

Install only if you are authorized to access the relevant Infinite Campus parent portal. Treat the password, cookie jar, XSRF token, terminal output, downloaded PDFs, messages, grades, attendance, and fee data as private student records; avoid shared or synced folders, do not commit outputs to repositories, and delete temporary session files and downloads when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill directs users to persist authenticated session material in a temporary cookie jar and then extract an XSRF token from it, but it does not warn that the jar contains live authentication artifacts equivalent to a logged-in parent session. In the context of student records, disclosure of that file to other local users, shell history, backups, or logs could enable unauthorized access to grades, attendance, messages, and documents until the session expires.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill provides a ready-made command to download portal documents directly to a local file, but it does not warn that the output may contain sensitive student records such as report cards or other education data. Writing such files to disk without guidance on secure location, naming, retention, or sharing increases the risk of accidental disclosure through synced folders, multi-user systems, backups, or later mishandling.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This documentation gives step-by-step commands to access highly sensitive student data such as grades, attendance, messages, assessments, and documents using live session credentials, but it does not prominently warn about FERPA/privacy implications, authorization boundaries, or safe handling of exported data. In a skill explicitly designed to pull real parent-portal data directly with curl, the lack of privacy and data-handling guidance materially increases the risk of accidental misuse, overcollection, and inappropriate storage or sharing.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The download example writes a report document directly to a predictable local filename without warning that the file may contain sensitive student records or that an existing file could be overwritten. In this context, the command encourages local persistence of protected data while omitting basic safeguards around filename selection, permissions, and cleanup.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The message retrieval section notes possible read-state changes but does not warn that the fetched HTML may contain sensitive message contents, student details, or other private communications. Because the skill is centered on direct extraction of parent-portal data, failing to mention confidentiality risks makes accidental exposure through terminals, logs, transcripts, or copied output more likely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.