Security audit

SYSU Anything Apple

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for SYSU Apple Calendar and Reminders automation, but users should review it because it relies on mutable npm-installed runtime code for write-capable campus and Apple-app actions.

Install only if you trust the SYSU-Anything publisher and are comfortable granting the runtime access to Apple Calendar/Reminders and SYSU account state. Prefer pinned npm versions, review the resolved package before running npx/npm, and require explicit confirmation before any command using --confirm or writing Apple items.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:27
Finding: Unpinned npm packages allow mutable third-party code execution
Content: View full analysis
Remediation: View remediation
``` 2. Avoid automatically suppressing installation confirmation with `-y` in agent-directed workflows. Require explicit user approval before downloading or executing a package. 3. Publish and document expected package integrity information, such as the npm distribution SHA-512 value, and verify it before execution in security-sensitive deployment environments. 4. Pin transitive dependencies in the externally installed runtime using a committed lockfile and reproducible release process. 5. Use npm provenance attestations, protected publishing with mandatory multi-factor authentication, and short-lived or trusted publishing credentials. 6. Separate package download from execution. Inspect the resolved version and package contents before invoking its binary. 7. Ensure the Skill checks and reports the installed runtime version rather than automatically upgrading to an unspecified latest release. 8. Audit the external `sysu-anything` runtime separately because it performs the authenticated campus and Apple operations that are outside this repository's source scope. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises writing reservation and task data into Apple Calendar and Reminders but does not warn users that the skill will modify personal productivity data or describe consent boundaries. In an agent context, this increases the chance of silent or surprising writes, accidental disclosure through synced accounts, and user confusion about what data is being created or altered.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run an unpinned package via npx ...@latest, which fetches and executes whatever version is current at install time. If the package account, publishing pipeline, or dependency chain is compromised, users could execute attacker-controlled code immediately during deployment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This is a second instance of the same unsafe install pattern: an unpinned npx invocation that executes remote package code at runtime. Because this skill is explicitly designed for deployment into an agent/IDE workflow, compromise of the package could lead to code execution in a sensitive developer environment.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs the agent to inspect runtime paths, login state, and a shared state directory, but it does not declare any explicit tool scope or allowed-tools boundary. That creates a permission-model gap where an agent may use environment-aware or shell-capable tooling more broadly than the skill metadata communicates, increasing the chance of unintended access to local state or execution of install commands.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description contains very broad activation language such as 'any fuzzy request' about Apple Calendar or Reminders integration for SYSU tasks. Over-broad routing can cause the skill to trigger in situations the user did not clearly intend, leading to unnecessary access to local Apple app integration paths, login-state checks, or write-capable commands for reservations and submissions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The default prompt uses broad, fuzzy trigger language like 'when the user wants' and 'including fuzzy requests', which can cause the skill to be invoked for ambiguous requests without clear user intent. In a skill that writes to Apple Calendar and Reminders, unintended invocation can lead to unwanted creation or modification of personal scheduling data and reduce user control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The deploy script unconditionally deletes the computed target skill directory with fs.rm(..., { recursive: true, force: true }) before copying files. If --dest or environment-influenced paths are mistaken, attacker-controlled, or point to an unexpected location, existing contents at that path are silently destroyed, causing data loss and potentially overwriting a broader bundle layout.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The overview prominently documents commands that can write to Apple Calendar/Reminders and, in some cases, submit real reservations or applications with --confirm, but it lacks a clear upfront warning that these actions modify local Apple data and may trigger remote state changes. In an automation or agent context, that omission increases the risk of unintended side effects because a user or calling system may treat the commands as informational rather than state-changing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The default prompt embeds Chinese example requests as the expected fuzzy invocation language, but does not indicate that users may interact in other languages or choose their locale. This can be read as preferring a specific language without explicit opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.