Security audit

infinitecampus-api

Security checks for vulnerabilities and agentic risk

Overview

This skill fits its stated purpose, but it deserves review because it handles real school portal credentials, session cookies, and sensitive student records without enough safety guidance.

Install only if you are authorized to access the Infinite Campus account and are comfortable handling protected student records manually. Use a trusted machine, keep credentials and cookies out of logs, store any downloaded documents in a secure location, delete temporary cookie jars and files when finished, and avoid opening message bodies unless changing read status is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs users to authenticate with real Infinite Campus credentials, store session cookies in a local jar, and extract the XSRF token, but it does not provide clear warnings about secret handling, token sensitivity, shell history exposure, file permissions, or cleanup of temporary artifacts. In this context, those credentials and session artifacts grant access to sensitive student and family data, so poor handling materially increases the risk of credential leakage or unauthorized account access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This file documents direct access to highly sensitive student and family data across grades, attendance, assessments, messages, documents, and fees, but it does not clearly warn users about FERPA/privacy obligations, least-privilege handling, or safe storage and sharing practices. In this skill context, the omission is more dangerous because the skill explicitly encourages bypassing the MCP and using real credentials plus session cookies in ad hoc scripts, which increases the chance of overcollection, mishandling, or disclosure of educational records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document download example writes potentially sensitive school records directly to a local file without warning about secure storage, filename hygiene, shared systems, backups, or accidental persistence. Because this skill is specifically designed for curl-based manual scripting with authenticated session material, users are more likely to run it on laptops, shell histories, CI hosts, or shared environments where downloaded student documents can be exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The download example writes remote content directly to a local filename without warning about safe destination handling, overwrites, or validating the source path/filename. While the sample uses a fixed output name, the surrounding workflow encourages taking document URLs from portal data, so users may save sensitive files insecurely or into unintended locations on multi-user systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The message retrieval section notes that fetching a message may mark it as read, but it presents the action as a normal retrieval flow without a strong caution that the request may change server-side state. In this context, that matters because investigators, parents, or support staff may unintentionally alter evidence, user-visible read status, or workflow state merely by following the documented curl command.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.