SYSU Anything CLI

Use when the user wants SYSU campus help through the SYSU Anything CLI, including natural-language requests such as 查课表、今天有什么课、教务系统、请假、雨课堂作业、ddl、签到、预约健身房、预约体...

Security Scan

The skill is internally coherent: it wraps and documents a campus CLI (sysu-anything), requests the expected binary / npm package, and its runtime instructions and install steps align with the described campus-help purpose.

Purpose & Capability

Name/description match the actual footprint: the skill expects the sysu-anything CLI and offers detailed guidance for campus tasks (jwxt, ykt, gym, libic, xgxt, career, etc.). Required binaries and the npm install target (sysu-anything) are proportional to the stated purpose.

Instruction Scope

SKILL.md instructs the agent to prefer the installed binary, check login state via sysu-anything commands, and consult local reference docs. It references a local state directory (~/.sysu-anything) and session files (session.json, chat-auth.json, etc.). This scope is expected for a CLI that manages site sessions, but it means the agent will interact with locally stored session tokens and may trigger network calls through the CLI — acceptable for the stated functionality but worth noting as sensitive.

Install Mechanism

Install uses npm (package name: sysu-anything), which is proportional to a Node-based CLI. npm installs carry the usual moderate risk (packages can include install scripts). The deploy script included only copies skill docs/refs and is not unexpected. No direct downloads from arbitrary URLs were found.

Credentials

The skill declares no environment variables and does not request unrelated credentials. It does rely on local session files under ~/.sysu-anything (session.json, ykt-session.json, etc.), which are appropriate for a campus CLI that maintains auth state. Those files may contain sensitive tokens, so access via the CLI is expected but sensitive; the skill itself does not demand unrelated secrets.

Persistence & Privilege

No always:true flag, no global forcing of presence, and the deploy script only copies skill files to a target directory when explicitly run. The skill does not request elevated or cross-skill config changes.

Assessment

This skill appears to be what it says: a wrapper for the sysu-anything CLI that helps manage campus tasks and login flows. Before installing or running it: 1) Confirm you trust the npm package author / repository (check the sysu-anything npm page and the GitHub repo referenced in package.json). 2) Prefer running one-off npx invocations (npx -y sysu-anything@latest ...) or inspect package contents before a global npm i -g, since npm installs can execute scripts. 3) Be aware the CLI will read and write session files under ~/.sysu-anything (these can contain tokens/cookies). If you are concerned about token exposure, review those files and consider running in a controlled environment. 4) If you want stronger assurance, inspect the upstream sysu-anything package source (postinstall scripts, network behavior) or run it in a sandbox/container. Additional information that would change the assessment: evidence of hidden remote endpoints, unexpected postinstall scripts in the npm package, or the skill asking for unrelated credentials would raise the risk level.

Use the published sysu-anything CLI instead of re-deriving campus APIs. Prefer the installed binary. If sysu-anything is missing, install the compiled package with npm i -g sysu-anything or use one-off calls via npx -y sysu-anything@latest .... If the user is actively developing the local repo, the checked-out workspace build is also acceptable.

If the user explicitly wants Apple Calendar / Apple Reminders integration on macOS, switch to the separate Apple entrypoint described in references/apple.md.

First step

1. Confirm the runtime path:
   • preferred: sysu-anything
   • one-off fallback: npx -y sysu-anything@latest
   • local-dev fallback inside the repo: npm run build
2. Prefer targeted help before composing a command:
   • sysu-anything --help
   • sysu-anything <command> --help
   • sysu-anything <command> <subcommand> --help
3. Before any login-dependent feature, read references/auth-and-state.md and identify what session or token is required.
4. Check login state before the real action:
   • bus: no login check needed
   • qg: no login check needed; prefer sysu-anything qg --help or sysu-anything qg list --today --available
   • ykt: sysu-anything ykt status
   • today / jwxt: sysu-anything jwxt status
   • chat: sysu-anything chat sources
   • gym: sysu-anything gym profile
   • libic: sysu-anything libic whoami
   • explore: sysu-anything explore whoami
   • usc: sysu-anything usc whoami --json
   • career list/detail: no login check needed
   • career teachin/jobfair signup or career job apply: no dedicated status endpoint; if the career write path may be stale, run sysu-anything auth workwechat first so the command can seed career-session.json
   • xgxt: sysu-anything xgxt current-user
5. If the check fails, restore login first, then rerun the check, and only after that run the user’s actual command.
6. If the user wants Apple Calendar / Reminders integration, read references/apple.md and run sysu-anything-apple apple doctor before the real sync command.
7. For chat send, prefer the campus-news scope first:
   • run sysu-anything chat sources
   • if the list contains 校园资讯 or 校内资讯, prefer that exact returned title by default
   • only switch to another scope when the user explicitly asks for it or the source list shows a better match

Routing

• If you are unsure where a capability lives, read references/overview.md.
• For login state and cached files, read references/auth-and-state.md.
• For career teachin/jobfair/job list/detail/signup/apply flows, read references/career.md.
• For offline Guangzhou shuttle lookup, read references/bus.md.
• For Qiguan rides between Zhuhai and Guangzhou, read references/qiguan.md.
• For Apple Calendar / Reminders integration, read references/apple.md.
• For Rain Classroom login, courses, classroom/check-in/homework flows, read references/ykt.md.
• For course timetable or leave flows, read references/jwxt.md.
• For campus chat login, scopes, or messaging, read references/chat.md.
• For gym availability or booking, read references/gym.md.
• For libic seminar-room refresh / availability / reservation flows, read references/libic.md.
• For USC / BPM classroom, meeting-room, and student-activity reservation flows, read references/usc.md.
• For explore seminar or research flows, read references/explore.md.
• For xgxt work-study or holiday leave/return-school flows, read references/xgxt.md.

Safety

• Login-dependent features must not skip the login check step.
• Read references/safety-and-confirm.md before any write operation.
• Prefer preview/query commands before mutation commands.
• Do not add --confirm unless the user clearly wants the real submission.
• Prefer the existing CLI over browser automation unless the user explicitly asks for a lower-level path.