KU Portal
v0.3.0고려대학교 KUPID 포털 조회. 공지사항, 학사일정, 장학공지, 도서관 좌석, 시간표, 수강과목, LMS 연동. (SonAIengine/ku-portal-mcp 기반)
⭐ 0· 476·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (KUPID portal, library, LMS, timetable) matches the code and instructions. The declared config paths (credentials.json, session caches, server.log, Downloads ICS) are relevant to the described login, caching, and export features. No unrelated credentials or binaries are requested.
Instruction Scope
SKILL.md and ku_query.py explicitly state they read ~/.config/ku-portal/credentials.json, create/modify ~/.cache/ku-portal-mcp/* and write ~/Downloads/ku_timetable.ics; commands call ku_portal_mcp library functions and perform network calls to the portal/LMS as expected. Instructions do not request broad, vague system data or exfiltrate to unexpected endpoints.
Install Mechanism
There is no registry-level install spec, but the repository includes scripts/setup.sh which creates a .venv and runs pip install --upgrade ku-portal-mcp (PyPI). Installing via pip from PyPI is standard for this type of wrapper, but users should be aware the install occurs locally into the skill venv rather than via a pre-reviewed system package. The script and pip usage are straightforward and do not download arbitrary archives or run unknown remote executables.
Credentials
No environment variables or unrelated credentials are requested by the skill. It expects a local credentials JSON file (id/pw) — proportional to SSO login requirements — and sets KU_PORTAL_ID / KU_PORTAL_PW at runtime for the imported library. The number and scope of required config paths are appropriate for caching sessions, logs, and ICS exports.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide agent settings. It writes only to its own .venv (during setup), ~/.cache/ku-portal-mcp/*, ~/.config/ku-portal/credentials.json (user-provisioned), and ~/Downloads/ku_timetable.ics. These are reasonable for its function.
Assessment
What to consider before installing:
- Trust the upstream package: setup.sh will pip-install ku-portal-mcp from PyPI into a local .venv; verify ku-portal-mcp's source and reputation (the SKILL.md/README point to SonAIengine and a fork). If you prefer, inspect the package source before installing.
- Credentials: the skill reads a plaintext JSON (~/.config/ku-portal/credentials.json) containing your KUPID id and password; follow the README's chmod 600 recommendation and avoid storing these credentials elsewhere. Consider using an account/password you can revoke if you are unsure.
- Local caches and logs: the skill creates session cache files (~/.cache/ku-portal-mcp/) and a server.log which may contain session info; if you run this on a multiuser system, be aware of their presence and remove them when not needed.
- Network activity: the skill will perform network requests to the university portal and Canvas LMS for authenticated operations—this is expected for its functionality.
- Review before granting: because installation is local (venv + pip), you can review ku_query.py, scripts/setup.sh, and the upstream package before running the installer. If you want extra assurance, run the venv creation and pip install in an isolated environment (temporary VM or container).
Overall, the skill's requirements and actions are coherent with its purpose; no unexplained credential or network exfiltration behavior was found.Like a lobster shell, security has layers — review code before you run it.
latestvk971dx2ecr8scmhgysf2dhj2c982mb9y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
Config~/.config/ku-portal/credentials.json, ~/.cache/ku-portal-mcp/session.json, ~/.cache/ku-portal-mcp/lms_session.json, ~/.cache/ku-portal-mcp/server.log, ~/Downloads/ku_timetable.ics