ClawHub
Back to skill

Security audit

SYSU Anything CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SYSU campus CLI helper, but its install and fallback paths can run mutable npm packages and its deployer can overwrite local AI/project instruction files without a clear safety gate.

Review before installing. Prefer a pinned, verified version of the npm packages instead of @latest, avoid deploying the ai-ide bundle into an existing project directory, and treat ~/.sysu-anything/ as sensitive because it can contain active campus sessions, tokens, and QR login artifacts. Only approve --confirm actions when the exact booking, submission, upload, or account change is intended.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Unpinned npm Packages Are Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:26-35; additional occurrences in README.md:17-27 and references/qiguan.md:73-87
Vulnerability Type: Unpinned third-party package retrieval and execution
Risk Level: Medium

Vulnerable Code

SKILL.md:26-35

markdown
Use the published `sysu-anything` CLI instead of re-deriving campus APIs. Prefer the installed binary. If `sysu-anything` is missing, install the compiled package with `npm i -g sysu-anything` or use one-off calls via `npx -y sysu-anything@latest ...`. If the user is actively developing the local repo, the checked-out workspace build is also acceptable.

If the user explicitly wants Apple Calendar / Apple Reminders integration on macOS, switch to the separate Apple entrypoint described in `references/apple.md`.

## First step

1. Confirm the runtime path:
   - preferred: `sysu-anything`
   - one-off fallback: `npx -y sysu-anything@latest`
   - local-dev fallback inside the repo: `npm run build`

README.md:17-27

markdown
Install for OpenAI Codex / Codex Cloud:

```bash
npx -y sysu-anything-cli-skill@latest deploy --target codex

Build a portable AI IDE bundle:

bash
npx -y sysu-anything-cli-skill@latest deploy --target ai-ide --dest ./SYSU-Anything.skill
text

`references/qiguan.md:73-87`

```markdown
If missing, it can be restored locally:

```bash
npm install -g qg-skill

Or enter the local project:

bash
cd /Users/baihe/Documents/岐关车cli
npm install
npm run build
npm link
text

### Technical Analysis

The Skill instructs the Agent or user to retrieve and immediately execute mutable npm package releases. In particular, `npx -y ...@latest` automatically accepts installation and executes whatever package version the registry currently identifies as the latest release.

Neither an exact package version nor an integrity digest is specified. Global npm installation can
...[truncated 2060 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version.
  2. Require explicit user approval before downloading or executing a missing package.
  3. Use a lockfile and npm integrity metadata for development and deployment dependencies.
  4. Verify package provenance, publisher identity, signatures, and release checksums where supported.
  5. Avoid global installation when a project-local, locked dependency can be used.
  6. Use --ignore-scripts where lifecycle scripts are not required, followed by an explicit and reviewed build step.
  7. Document the expected package owner, repository, exact version, and checksum.
  8. Treat upgrades as separate reviewed actions rather than silently resolving to the latest release.
  9. Run campus tooling with the minimum filesystem and network privileges necessary, particularly because the runtime can access persisted authentication tokens.

T09 · Insecure Skill Coding Practices

Warning
Location
bin/deploy.mjs:96
Finding

AI IDE Deployment Unconditionally Overwrites Existing Project Files

Content
View full analysis

Vulnerability Details

File Location: bin/deploy.mjs:96-140
Vulnerability Type: Unsafe file overwrite during deployment
Risk Level: Medium

Vulnerable Code

javascript
async function writeAiIdeBundleDocs(rootDir) {
  const readmePath = path.join(rootDir, "README.md");
  const agentsPath = path.join(rootDir, "AGENTS.md");
  const readme = `# SYSU-Anything.skill

This portable bundle lets AI IDEs load the SYSU-Anything campus skill pack without pulling the full campus runtime source code into npm.

Included skills:

- \`sysu-anything-cli\`: shuttle, Qiguan, JWXT, YKT, chat, gym, libic, explore, career, xgxt
- \`sysu-anything-apple\`: macOS Apple Calendar / Reminders campus automation

Recommended usage:

1. Point your AI IDE to this folder as a local prompt or skill pack.
2. Prefer the two bundled skill folders as the canonical campus workflow layer.
3. Keep this folder versioned or synced across machines.
`;
  const agents = `# SYSU-Anything.skill

When the user asks about SYSU campus workflows, prefer these local skill packs:

- ./sysu-anything-cli
- ./sysu-anything-apple

Use them as the primary operating layer for campus services, Apple sync, and agent-native campus actions.
`;

  await fs.writeFile(readmePath, readme, "utf8");
  await fs.writeFile(agentsPath, agents, "utf8");
}

async function deploy(target, dest) {
  const rootDir = resolveTargetRoot(target, dest);
  const skillDir = path.join(rootDir, SKILL_NAME);

  await fs.rm(skillDir, { recursive: true, force: true });
  await fs.mkdir(skillDir, { recursive: true });

  for (const item of COPY_ITEMS) {
    await copyRecursive(path.join(PACKAGE_DIR, item), path.join(skillDir, item));
  }

  if (target === "ai-ide") {
    await writeAiIdeBundleDocs(rootDir);
  }
}

Technical Analysis

For the ai-ide deployment target, the user-supplied --dest value becomes rootDir. The deployment funct ...[truncated 2380 chars]

Remediation
View remediation

Remediation Suggestions

  1. Refuse to overwrite existing README.md or AGENTS.md files by default.
  2. Add an explicit --force option and require it before any replacement.
  3. Display every file that will be created, deleted, or overwritten before deployment.
  4. Require an empty destination directory for portable bundle generation.
  5. Prefer writing all generated content beneath a dedicated bundle subdirectory instead of the selected project root.
  6. If replacement is explicitly authorized, create timestamped backups first.
  7. Use exclusive file creation mode for the safe default, such as opening files with the wx flag.
  8. Use temporary files and atomic renames to prevent partially written output.
  9. Add automated tests covering existing destination files, symlinks, non-empty repositories, and deployment interruption.
  10. Clearly document that --dest must identify a new bundle directory rather than an existing source repository.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to execute an unpinned package via npx ...@latest, which fetches and runs whatever code is currently published under that package name. If the package is compromised, hijacked, or a malicious version is published, users may execute attacker-controlled code during installation/deployment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This command also relies on @latest, causing the tool to download and execute the newest published package without review or reproducibility guarantees. In the context of a campus-services skill that may interact with login and reservation workflows, compromise of the installer could expose credentials, tokens, or local environment data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill instructs the agent to invoke local binaries and npm/npx, which exposes execution capability, but it does not declare an explicit tool scope such as allowed-tools or permissions. That mismatch can cause the agent or reviewers to underestimate what the skill is allowed to do, increasing the chance of unintended command execution or environment access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description contains broad fuzzy-trigger language covering many campus-related requests, bookings, schedules, reminders, and login recovery. Overbroad routing increases the chance that the skill is selected for ambiguous requests and then performs sensitive campus-account actions, including login-dependent operations, in contexts where a narrower skill or additional confirmation would be safer.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npm i -g sysu-anything and one-off execution via unpinned npx -y sysu-anything@latest allows the agent to fetch and run whatever package version is current at execution time. If the package is compromised, typosquatted, or updated with malicious code, this becomes a direct remote code execution and supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The fallback command explicitly recommends npx -y sysu-anything@latest, which executes the newest published package without review or version locking. In an agent context this is especially risky because a routine help or status check can trigger execution of untrusted code from the registry.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The default prompt uses a broad catch-all phrase ('other campus-service tasks') that can cause the agent to invoke this skill for loosely related or ambiguous requests. Overly broad routing increases the chance of misfires, where sensitive campus actions like bookings, schedule access, or login-related workflows are triggered without sufficient user intent clarity or with the wrong skill context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The deploy routine forcefully removes the existing destination directory with fs.rm(..., recursive: true, force: true) before recreating it. Although success is logged afterward, there is no warning, confirmation, or pre-action disclosure at the point of deletion to alert users that existing files at the target path will be erased.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/apple.md (reported line 25)May include surrounding context.

sysu-anything-apple apple doctor

text

Optional write test:

```bash
sysu-anything-apple apple doctor --write-test

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document explicitly enumerates persistent session and bearer-token files for multiple campus services, but provides no warning that these artifacts are sensitive credentials equivalent to active logins. In this skill context, that is more dangerous because the agent is instructed to use and recover authenticated state across many services, increasing the chance that downstream tooling, logs, or users mishandle these files and expose reusable tokens.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill description and command guidance are written in Chinese, with no indication that users may interact in other languages or choose a locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation instructs users to generate auth URLs, replay authentication callbacks, and store tokens locally, but it does not warn that these actions handle live authentication artifacts and may persist credentials on disk. In an agent setting, this increases the chance of accidental token capture, unsafe logging, or unintended transmission of sensitive session material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The overview explicitly documents booking, submission, signup, apply, and Apple Calendar/Reminders write flows, but it does not consistently present a prominent user-facing warning that these commands can change external systems or create records. In an agent setting, that omission increases the risk that the agent executes state-changing actions without clear informed consent, especially because the skill encourages direct use of write-capable commands across multiple campus systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill file is written in Chinese and provides no indication that users may interact in another language or opt into this locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation states that structured homework answers may include local file paths and that the CLI will automatically upload those attachments, but it does not clearly warn the user that local file contents will be transmitted to a remote Rain Classroom service. In an agent-driven context, this increases the risk of unintended exfiltration of sensitive local files if a path is supplied incorrectly, inferred too broadly, or selected without explicit user confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents all user-facing instructions in Chinese and does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The instructions hard-code Chinese scope names as the default operating behavior and do not provide any user opt-in or alternative locale handling. A forced language or locale choice in natural-language instructions can violate organizational language/locale policy when no choice is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language instructions in this file are fully Chinese and do not indicate that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The Apple Reminders import section describes creating or updating reminders on the user's device/account but does not clearly warn that running the command will modify personal reminder data. In an automated assistant setting, silent state-changing actions on a user's account can be surprising and may cause unwanted calendar/task pollution or overwrite assumptions about reminder state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.