Treehole

PKU Treehole (北大树洞) anonymous forum CLI tool built in Rust. Use this skill when working on the treehole crate, debugging treehole commands, adding features t...

Security Scan

The skill's description matches a Treehole CLI helper, but the runtime instructions expect access to local secrets (OS keyring, session files, and an SMS code env var) while the metadata declares no required env/config — this mismatch is concerning and worth verification before use.

Purpose & Capability

Name/description and the SKILL.md consistently describe a PKU Treehole CLI helper; that purpose is coherent. However, the manifest declares no required env vars or config paths while the SKILL.md explicitly documents reading credentials from the OS keyring, an env var (PKU_SMS_CODE), and persisting sessions to ~/.config/info/treehole/. The absence of those declared requirements is an inconsistency.

Instruction Scope

The SKILL.md instructs agents to perform auth flows (IAAA SSO, JWT callback), auto-login using credentials from the OS keyring or env, and to persist/read session data from a home-directory path. Those are legitimate for a CLI client, but they involve accessing sensitive local secrets (keyring, session tokens) and an SMS code env var; the skill instructions therefore reach beyond purely read-only help text and could cause the agent to use or transmit secrets.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by an installer step — lowest install risk.

Credentials

Although the manifest lists no required environment variables or config paths, the SKILL.md expects PKU_SMS_CODE and credential resolution from the OS keyring (and fallback to env). Requesting or using those secrets is reasonable for login functionality, but the skill should have declared them. The undeclared access to keyring/session files reduces transparency and is disproportionate to what the metadata advertises.

Persistence & Privilege

The CLI persists session state to ~/.config/info/treehole/ (JWT/session tokens) per the docs. That behavior is expected for a CLI client and the skill is not configured as always:true. Still, persisted tokens are sensitive — verify how they are stored and how to revoke them if needed.

What to consider before installing

This skill appears to be a helper for the Treehole CLI, but its runtime instructions expect access to local credentials (OS keyring), a PKU_SMS_CODE env var, and session files even though the skill metadata declares none. Before installing or enabling it: 1) confirm the skill's source and inspect the actual code or repo (the package lists no homepage/source). 2) Do not set PKU_SMS_CODE as a persistent global environment variable; prefer ephemeral use if you must test. 3) Be cautious about allowing any agent to read your OS keyring or session files — run in a sandboxed account or VM if possible. 4) Verify how session tokens are stored and how to revoke them (or delete ~/.config/info/treehole/) after use. 5) If you rely on this for course/schedule answers, consider cross-checking with other official sources. If the publisher can provide the crate repository or a signed release, that would materially increase confidence.

Treehole - 北大树洞 CLI

A CLI client for PKU's anonymous discussion platform (PKU Helper Treehole).

Architecture

• Crate location: crates/treehole/
• Auth flow: IAAA SSO (app_id="PKU Helper") → JWT callback at /chapi/cas_iaaa_login → optional SMS verify
• API: JSON REST at /chapi/api/v3/* (modern) and /chapi/api/* (legacy)
• API docs: docs/treehole-api.md

Key Source Files

• src/main.rs — Clap CLI definition with all subcommands
• src/commands.rs — Command implementations (login, post, search, etc.)
• src/api.rs — HTTP API client, request builders, response types
• src/display.rs — Terminal output formatting with colored crate
• src/client.rs — reqwest client builders (build for auth, build_simple for IAAA)

CLI Commands

Command	Alias	Function
login		IAAA password/QR login → JWT
logout / status		Session management
list	ls	Browse posts/feed
show		View single post with replies
search		Full-text search
post		Create post (text, tags, images, rewards/树叶)
reply		Reply to a post
like / tread		Vote on posts
star / unstar / stars		Bookmark management
follow / unfollow		Follow posts
msg / read		Notifications
me		Profile + own posts
score		Grade query (with color rendering)
course		Weekly course schedule (canonical source — includes 主修 + 辅修 + 双学位)
schedule		This week's day-by-day schedule
academic-cal / activity-cal		Academic / activity calendar
otp		TOTP 2FA management (bind/set/show/clear)

Auto-Login for AI Agents

# Check session status
info-auth check

# Auto-login (reads credentials from OS keyring, no password needed)
treehole login -p

# If SMS verification is needed (first login or periodic):
PKU_SMS_CODE=123456 treehole login -p

Treehole may require SMS verification on first login or periodically (~30 days). When PKU_SMS_CODE env var is set, it auto-confirms sending and submits the code without interactive prompts.

Development Conventions

• All user-facing strings are in Chinese (prompts, errors, output)
• Error handling: anyhow::Result with .context("中文描述")
• HTTP client uses redirect(Policy::none()) for manual redirect handling
• Session persisted to ~/.config/info/treehole/ via info_common::session::Store
• Credentials resolved via info_common::credential (keyring → env → interactive)
• Shared auth from info-common crate (see info-common skill for details)