uni-course-scheduler

• Outcome: Pass
• Latest audit: Oct 23, 2026 · 4:20 AM UTC
• Version: 2.7.14

Overview

The skill provides course planning with consent-controlled cloud processing, but its automated checks cannot guarantee accurate schedules or supported recommendations.

Verify class times, prerequisites, and degree requirements against official university sources; the bundled validators are incomplete. Local mode avoids the optional cloud transfer. For cloud use, review the provider, student information sent, and fee for every submission. Keep tokens out of chat and use a reviewed CLI version.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

Option B — manual install

bash

# 1. Unzip the package (installs as a plain skill folder — no background service, no cron, no persistent state)
mkdir -p ~/.workbuddy/skills && cd ~/.workbuddy/skills
unzip /path/to/uni-course-scheduler.zip

# 2. Verify the folder structure

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md

count you have not checked.

3. Before submitting any cloud run: show the platform's current fee estimate and
   obtain the user's **explicit confirmation in the current conversation**. No
   confirmation, no submission.
4. If the user has no LoomLoom token/balance, guide them through the platform's own account flow (`loomloom login`, or the platform's own sign-up/billing flow). All cloud submissions require an
   explicit human confirmation (fee + data disclosure) in the current conversation — the agent never auto-submits paid runs.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/loomloom-setup.md (reported line 144)May include surrounding context.

text

5. **Show the platform's estimated fee to the student and get explicit human confirmation**
   (never submit without confirmation; this is the human-in-the-loop gate — no auto-submission of paid runs).

6. **Execute** (generate a new client-request-id per run):
   ```bash

The documented exact timetable matching accepts mismatched end times as passing.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

When a schedule entry matches a catalog course, day, and start time but has a different end time, the checker emits only a warning and still returns passed=true with exit code 0. An untrusted cloud output can therefore supply fabricated session durations that pass the documented exact-match gate, potentially producing misleading schedules or undetected conflicts. This is particularly relevant because the script is intended to enforce factual boundaries; the explicit warn-pass regression test suggests an intentional tolerance policy rather than malicious intent, but that policy weakens the stated guarantee.

Content

No source excerpt is available for this finding.

The module claims to check evidence presence and citation completeness, but neither check is implemented.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The audit claims to check evidence and citation completeness, but its implemented checks allow unsupported course information and recommendations to satisfy all validation criteria. If downstream processing trusts this audit, that gap could allow fabricated academic guidance into generated spreadsheets; this is an integrity risk, not evidence of malicious behavior. As written, the separate datetime.now() error prevents normal report completion, so successful exploitation through a reported PASS is not demonstrated in the current script.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 28)May include surrounding context.

text

# Cloud Service Proprietary Notice

This MIT license applies only to the **local files** in this repository (and in the shipped
package), including but not limited to:
`SKILL.md`, `README*`, `scripts/`, `references/`, `agents/`, `skill.json`, `manifest.json`
and the rest of the installable, runnable local Skill code and text. You may use, modify and
distribute these local files freely, including commercially.

Static analysis

No suspicious patterns detected.