Security audit

BilimClass

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for BilimClass, but it should be reviewed because it handles long-lived school account tokens and may read credentials from an unexpected Windows profile path.

Review this before installing. Treat the BilimClass tokens like passwords, keep ~/.openclaw/.env.json private and out of repositories or screenshots, and prefer removing the hard-coded Windows profile fallback and narrowing triggers so the skill only runs on explicit BilimClass requests.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/bilimclass.py:19
Finding: Undeclared Fixed-Profile Credential File Access
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:30
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
=2.32.0,<3.0.0 ``` 2. For reproducible deployments, generate a lock file containing exact versions of direct and transitive dependencies. 3. Use hash verification where practical: ```bash pip install --require-hashes -r requirements.txt ``` 4. Install dependencies inside a dedicated virtual environment rather than the system Python environment. 5. Configure installation to use a trusted package index over HTTPS and avoid untrusted mirrors. 6. Add automated dependency vulnerability scanning and periodically update the lock file after reviewing release and security information. 7. Update the runtime error message to refer users to the locked installation process rather than the mutable `pip install requests` command. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup instructs users to extract a long-lived JWT from browser localStorage and place it in a local config file, but it does not clearly warn that this token effectively grants account access and may remain valid for about a year. This increases the risk of accidental exposure through screenshots, shell history, backups, repository commits, or local compromise, which could let someone access the student's school data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README states the skill auto-triggers on broad school-related natural-language phrases such as homework, grades, diary, and schedule queries. In an agent environment, broad triggers can cause unintended invocation on ordinary conversation, leading the skill to access and disclose sensitive student data when the user did not explicitly intend to call this integration.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill requires environment access for secrets and network access to external APIs, but it does not declare an explicit tool scope or allowed-tools policy. That omission weakens least-privilege controls and makes it harder for a host system to constrain what the skill may access or transmit, increasing the chance of unintended secret use or broader execution than users expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes very broad phrases such as "any school-related queries for Kazakhstan students," which can cause the skill to activate for unrelated or only loosely related requests. Because this skill handles sensitive educational data and uses stored credentials, accidental invocation could lead to unnecessary access to grades, homework, or schedule information without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup instructions explicitly tell users how to extract long-lived JWTs from localStorage and browser network headers, but do not warn that these are bearer credentials that grant access to student data. Publishing operational token-extraction steps without handling guidance increases the likelihood of credential leakage, reuse, or unsafe sharing, especially since one token is valid for about a year.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script loads tokens and user identifiers from a local .env.json file and immediately uses them in Authorization headers for remote requests. While the code performs network access to an external service and accesses sensitive credentials, there is no docstring, comment, or user-facing warning explaining that stored tokens and student account data will be transmitted.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
STUDENT_UUID = bc["studentSchoolUuid"] STUDENT_GROUPS = bc.get("studentGroups", []) API_BASE = "https://api.bilimclass.kz/api/v4/os/clientoffice" JOURNAL_BASE = "https://journal-service.bilimclass.kz/diary" HEADERS = {

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/bilimclass.py (reported line 44)May include surrounding context.
python
STUDENT_UUID = bc["studentSchoolUuid"] STUDENT_GROUPS = bc.get("studentGroups", []) API_BASE = "https://api.bilimclass.kz/api/v4/os/clientoffice" JOURNAL_BASE = "https://journal-service.bilimclass.kz/diary" HEADERS = {

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Both request header sets hard-code "X-Localization": "ru", which imposes a specific language/locale policy on all API interactions. There is no indication that the user can opt into another locale or that the Russian-only behavior is a documented regional requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented API headers force X-Localization: ru for both schedule and grades requests. This imposes a specific language/locale behavior without indicating user opt-in or explaining why Russian is required.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.