schoolpass

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:06 PM UTC
• Version: 0.4.2

Overview

The skill is coherent for SchoolPass parent-account use, but it asks users to run an unpinned external MCP package with persistent SchoolPass credentials and includes real child dismissal changes.

Review this before installing because it handles sensitive child and parent data and can make real dismissal changes. Use a pinned, reviewed server version if available, avoid project-level credential files, keep secrets out of source control and backups, restrict file permissions, and require explicit user confirmation before any dismissal submission or cancellation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22
• Finding: Unpinned Third-Party Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 22-25 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: High ```json "schoolpass": { "command": "npx", "args": ["-y", "schoolpass-mcp"], ``` ### Technical Analysis The documented MCP configuration invokes `npx` with the `-y` option and an unversioned package name. This causes npm to resolve, download when necessary, and execute the package without interactive approval. Because no exact version or integrity digest is specified, the effective executable payload can change after this Skill has been reviewed. The implementation of `schoolpass-mcp` is not included in the audited project, so its handling of credentials, host overrides, API responses, and local process permissions cannot be independently verified from the available artifact. The package receives the configured SchoolPass email and password and executes with the filesystem, network, and process privileges of the MCP host. This is a supply-chain exposure rather than proof that the current published package is malicious. Exploitation would require compromise or malicious modification of the package, its release process, its maintainer account, or the package-resolution environment. ### Attack Path 1. A user adds the documented configuration and starts the MCP server. 2. `npx -y schoolpass-mcp` resolves the package version available from the configured npm registry. 3. A compromised or malicious release is downloaded and executed without an interactive review step. 4. The package receives `SCHOOLPASS_EMAIL`, `SCHOOLPASS_PASSWORD`, and `SCHOOLPASS_SCHOOL_CODE` through its environment. 5. Malicious package code can transmit those credentials or access other resources available to the MCP process. ### Impact Assessment A compromised dependency could obtain the user's SchoolPass credentials and access sensitive parent and child records, including st ...[truncated 567 chars]
• Remediation: ## Remediation Suggestions - Pin `schoolpass-mcp` to a specific, reviewed version rather than resolving the latest available release. - Use a lockfile and verified package integrity metadata where supported. - Avoid unattended installation with `npx -y`; install and review the dependency through a controlled deployment process. - Include the MCP server implementation in the audited artifact or vendor a reviewed build so its behavior can be verified. - Run the server in a sandbox with restricted filesystem access, a minimal environment, and outbound network access limited to validated SchoolPass API hosts. - Monitor dependency ownership, release provenance, and unexpected package-version changes. - Re-audit the package before upgrading to a new version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:17
• Finding: SchoolPass Password Is Stored in Plaintext MCP Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 17-30 **Vulnerability Type**: Plaintext credential storage in project or user configuration **Risk Level**: High ```markdown Add to `.mcp.json` in your project or `~/.claude/mcp.json`: ```json { "mcpServers": { "schoolpass": { "command": "npx", "args": ["-y", "schoolpass-mcp"], "env": { "SCHOOLPASS_EMAIL": "[e-mail]", "SCHOOLPASS_PASSWORD": "your-password", "SCHOOLPASS_SCHOOL_CODE": "1183" } } } } ``` ``` ### Technical Analysis The setup instructions direct users to place their SchoolPass email and password directly into either a project-level `.mcp.json` file or the user-level `~/.claude/mcp.json` file. Although the example contains placeholders rather than real credentials, following the instructions results in a real password being stored as plaintext configuration. A project-level configuration is particularly exposed because it may be committed to source control, copied into support bundles, shared with collaborators, or synchronized through backup services. A user-level configuration may also be readable by other processes running under the same account. The documentation does not require restrictive file permissions, secret-manager integration, repository ignore rules, or runtime-only credential injection. The credential access is necessary for the declared account-reading functionality if SchoolPass supports only password-based authentication. Persisting that password in a broadly accessible configuration file, however, is not the minimum-risk method of supplying it to the service. ### Attack Path 1. A user copies the example into a project or home-directory MCP configuration. 2. The user replaces the placeholder with a valid SchoolPass password. 3. The configuration is committed, backed up, shared, included in diagnostic output, or read by another local process. ...[truncated 893 chars]
• Remediation: ## Remediation Suggestions - Retrieve the password from an operating-system keychain, credential manager, or dedicated secret-management service instead of embedding it in JSON. - Inject credentials only at process startup and avoid persisting them in project files. - Prefer a scoped, revocable API token or OAuth-style authorization if SchoolPass supports one. - If file-based configuration is unavoidable, place secrets in a separate ignored file and enforce owner-only permissions. - Add explicit instructions to exclude `.mcp.json` and related secret files from source control, backups, logs, support bundles, and shared archives. - Validate that the MCP server never logs credentials, session tokens, authorization headers, or credential-bearing environment data. - Encourage use of a unique SchoolPass password and immediate credential rotation after any suspected configuration exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes the skill as being for reading a parent's SchoolPass account, but the documented toolset includes write operations that can submit or cancel a child's dismissal change. This mismatch can cause an orchestrator or user to invoke the skill under read-only expectations while the skill actually exposes real-world state-changing actions affecting child pickup and attendance workflows.

MCP Config Access

High

• Category: Agent Snooping

Content

## Setup

Add to `.mcp.json` in your project or `~/.claude/mcp.json`:

```json
{

• Confidence: 95% confidence
• Finding: The setup instructs users to place SchoolPass credentials in project or home MCP configuration, which exposes highly sensitive account secrets to local file access, other tools, and potentially the model runtime. In this context, the credentials protect parent access to child identity, schedules, pickup drivers, and dismissal-change functions, so compromise can directly expose family data and enable unauthorized operational changes.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger text includes a broad catch-all phrase like 'any request to read a SchoolPass parent account,' which can activate the skill on loosely related requests. Over-broad activation increases the chance of unnecessary account access, inadvertent exposure of sensitive family/student information, or routing a conversation into a high-trust skill when a narrower tool should have been used.

Static analysis

No suspicious patterns detected.