Classislandcli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.3

Overview

This schedule-management skill is not clearly malicious, but it can change timetable data and also asks the agent to install unverified software and modify the user environment.

Review this before installing. Prefer manually installing and verifying ClassIslandCLI yourself, avoid letting the agent run install or overwrite commands, and require explicit confirmation plus a backup before deletions, permanent class swaps, or profile/path changes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skill.md:137

Finding

Unverified Remote Executable Download and Execution

Content

View full analysis

Vulnerability Details

File Location: skill.md, line 137
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete vulnerable instruction, faithfully translated into English:

markdown

1. **First use**: Check whether ClassIslandCLI.exe is in PATH. If it does not exist or is damaged, retrieve the portable package download address from https://gitee.com/api/v5/repos/buger2008/ClassIslandCLI/releases?page=1&per_page=20&direction=desc, download the package for the applicable platform, extract it into PATH.

Technical Analysis

The skill directs the agent to obtain an executable from a mutable release endpoint belonging to a third-party repository, extract it into a directory on PATH, and use it to perform subsequent operations. It does not require an immutable artifact version, expected cryptographic hash, trusted publisher signature, authenticated manifest, or other integrity verification before execution.

Consequently, the executable ultimately run by the agent can differ from the payload present when the skill was audited. Compromise of the repository owner account, release infrastructure, API response, or distributed archive could substitute arbitrary executable code. Installing the downloaded program on PATH also creates a tool-substitution risk because later calls to ClassIslandCLI.exe may resolve to the unverified binary.

Attack Path

1. An attacker compromises or otherwise gains control over the referenced repository, release account, release artifact, or distribution channel.
2. The attacker publishes a modified portable package containing a malicious ClassIslandCLI.exe.
3. On first use, or when the existing executable is considered missing or damaged, the agent follows the skill instruction and queries the mutable release endpoint.
4. The agent downloads the attacker-controlled package and extracts it into a directory on PATH without validating ...[truncated 863 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic discovery and download of executables from a mutable release endpoint.
2. Distribute an audited binary with the skill or use an official, authenticated package-management channel.
3. Pin an exact release version and use an immutable artifact URL rather than selecting the latest available release.
4. Publish and enforce a known SHA-256 or stronger digest for each supported platform package. Abort installation if verification fails.
5. Verify a trusted publisher signature or signed release manifest before extracting or executing the artifact.
6. Install the executable in a dedicated, access-controlled application directory rather than a shared PATH directory.
7. Invoke the verified executable through an absolute path to prevent path-precedence and executable-substitution attacks.
8. Extract archives into a controlled temporary directory first, validate archive entries against path traversal, inspect the expected file set, and only then install the verified binary.
9. Require explicit user approval before downloading, installing, replacing, or executing an external binary.
10. Document the trusted publisher, expected version, hashes, signature-verification procedure, and rollback process in the skill.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The auto trigger is overly broad for a skill that includes destructive and administrative commands. Broad activation increases the chance of accidental invocation in unrelated conversations, which can lead to unintended deletions, configuration changes, or setup actions without a clear user intent boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents destructive commands such as deleting subjects/time layouts and permanently reordering classes without requiring confirmation or warning about irreversible effects. In an agent setting, ambiguous user requests or mistaken parsing could cause loss or corruption of timetable data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

--InstallSkills can overwrite WorkBuddy skills, which is an administrative capability outside the stated timetable-management scope. If invoked accidentally or through prompt confusion, it could modify the agent environment and replace trusted skills with unintended content, expanding impact beyond the user's timetable data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes a command-line tool for managing ClassIsland subjects, timetables, and class plans. --InstallCompletions modifies the user's shell environment across multiple shells, which is an auxiliary system-configuration capability not justified by the stated scheduling-management purpose itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The usage guide instructs obtaining software from an external URL when the executable is missing, introducing software retrieval behavior beyond the timetable-management task. This creates supply-chain and prompt-injection risk because an agent following the instruction may fetch and trust external content without independent verification.

Content

No source excerpt is available for this finding.