Xuexitong Homework Submit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:12 PM UTC
• Version: 1.1.2

Overview

The skill’s homework automation purpose is clear, but its credential handling can expose Chaoxing session cookies through unvalidated URLs and plaintext HTTP uploads.

Review this skill before installing. It automates real homework account actions and uses your Chaoxing cookie. Only use it with your own account, avoid untrusted task or homework URLs, protect and rotate the cookie if you have used the handwriting upload path, and prefer a fixed version that validates Chaoxing HTTPS hosts, removes the global raw Cookie header, propagates the selected cookie to child processes, and pins dependencies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xuexitong_submit.py:69

Finding

Authentication Cookie Disclosure Through Unvalidated Request URLs

Content

View full analysis

requests.Session: """Create a session that sends cookies as a CookieJar (more reliable than raw Cookie header).""" s = requests.Session() s.headers.update( { "User-Agent": ua, "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.9", "Referer": "https://mooc1-api.chaoxing.com/work/stu-work", # Many Chaoxing endpoints behave differently depending on whether cookies are sent # as a raw header vs cookie jar. We set BOTH for maximum compatibility. "Cookie": cookie_header, } ) # Populate cookie jar for kv in cookie_header.split(";"): kv = kv.strip() if not kv or "=" not in kv: continue k, v = kv.split("=", 1) k = k.strip() v = v.strip() if not k: continue s.cookies.set(k, v, domain=".chaoxing.com") return s ``` The same authenticated session is then used with caller-controlled URLs without validating their scheme, hostname, or port: ```python def resolve_mtask_to_dohomework(s: requests.Session, task_url: str, sleep_ms: int = 0) -> str: if sleep_ms: time.sleep(sleep_ms / 1000) r = s.get(task_url, timeout=30) r.raise_for_status() html = r.text # Find doHomeWork URL inside the page # pattern i ...[truncated 4273 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xuexitong_hw_pipeline.py:256

Finding

Authenticated Homework Upload Uses Plaintext HTTP

Content

View full analysis

dict: url = "http://notice.chaoxing.com/pc/files/uploadNoticeFile" with open(file_path, "rb") as f: files = {"attrFile": (f"{int(time.time()*1000)}{file_path.suffix}", f)} r = s.post(url, files=files, timeout=30) r.raise_for_status() j = r.json() if not j.get("status"): return {"ok": False, "resp": j} # stable url without query u = (j.get("url") or "").split("?")[0] return {"ok": True, "url": u, "raw": j} ``` The supplied session is created with the complete Chaoxing cookie as a raw default header: ```python def make_session(cookies: dict) -> requests.Session: s = requests.Session() cookie_header = "; ".join([f"{k}={v}" for k, v in cookies.items()]) s.headers.update( { "User-Agent": DEFAULT_UA, "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.9", "Referer": "https://mooc1-api.chaoxing.com/work/stu-work", # Some endpoints behave differently if cookies are not also present as a raw header "Cookie": cookie_header, } ) # populate cookie jar (best-effort) for k, v in cookies.items(): s.cookies.set(k, v, domain=".chaoxing.com") return s ``` ### Technical Analysis The upload endpoint explicitly uses `http://`, so transport encryption and server authentication are absent. The request contains the rendered homework answer image and, because the session defines a raw default `Cookie` header, the user's authentication cookie. An on-path attacker can passively read the traffic or actively modify the request and response. The c ...[truncated 1343 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/xuexitong_scan_pending.py:42

Finding

Custom Credential Selection Is Not Propagated to Child Processes

Content

View full analysis

str: here = os.path.dirname(os.path.abspath(__file__)) py = os.path.join(here, "xuexitong_submit.py") vpy = os.path.join(os.path.dirname(here), ".venv", "bin", "python") cmd = [vpy, py] + args # Avoid repeated GitHub checks for each subprocess call in scan flow. env = dict(os.environ) env["XUEXITONG_SKIP_UPDATE_CHECK"] = "1" return subprocess.check_output(cmd, env=env).decode("utf-8") ``` ```python ap.add_argument( "--cookie", default=os.path.expanduser("~/.openclaw/credentials/xuexitong_cookie.txt"), help="cookie file path", ) ... tasks = json.loads(run_submit_py(["list"]))["tasks"] tasks = tasks[: args.limit] resolved = [] resolve_failures = [] seen = set() for t in tasks: try: do = run_submit_py(["resolve", "--task-url", t]).strip() except Exception: resolve_failures.append(t) continue ``` The handwriting pipeline has the same issue when invoking the save operation: ```python def temp_save_homework(*, dohomework_url: str, work_json_path: Path, answers_html_path: Path, out_result: Path): # call existing submit script to ensure per-question hidden fields are handled skill_dir = Path(__file__).resolve().parents[1] submit_py = skill_dir / "scripts" / "xuexitong_submit.py" venv_py = skill_dir / ".venv" / "bin" / "python" cmd = [ str(venv_py), str(submit_py), "save", "--dohomework-url", dohomework_url, "--answers" ...[truncated 2662 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/xuexitong_scan_pending.py (reported line 53)May include surrounding context.

python

cmd = [vpy, py] + args

    # Avoid repeated GitHub checks for each subprocess call in scan flow.
    env = dict(os.environ)
    env["XUEXITONG_SKIP_UPDATE_CHECK"] = "1"

    return subprocess.check_output(cmd, env=env).decode("utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and instructs use of scripts that require network, shell, file read/write, and access to credential-like cookie files, but the manifest does not declare any explicit tool scope or permissions boundaries. This is dangerous because operators and policy systems cannot accurately constrain what the skill is allowed to do, increasing the risk of over-privileged execution, unintended credential access, and silent network exfiltration if the referenced scripts are malicious or compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The pipeline intentionally persists sensitive workflow artifacts to disk, including question content, answer text, uploaded image URLs, and HTML answer payloads. In the context of an authenticated homework automation tool, these files may expose private academic content or enable reuse/manipulation by other local users or malware if stored with weak filesystem protections.

Content

Scanner excerpt · scripts/xuexitong_hw_pipeline.py (reported line 10)May include surrounding context.

python

- generate editable answers template (with stems)
- (after user edits) render handwritten PNGs on grid background
- upload PNGs to Chaoxing cldisk (uploadNoticeFile)
- write HTML <img> answers.json
- temp-save (暂存) to homework

Design goals:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/xuexitong_hw_pipeline.py (reported line 247)May include surrounding context.

python

"--bg",
        str(bg_path),
    ]
    p = subprocess.run(cmd, capture_output=True, text=True)
    if p.returncode != 0:
        raise SystemExit(p.stderr or p.stdout)
    try:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/xuexitong_hw_pipeline.py (reported line 319)May include surrounding context.

python

"--bg",
        str(bg_path),
    ]
    p = subprocess.run(cmd, capture_output=True, text=True)
    if p.returncode != 0:
        raise SystemExit(p.stderr or p.stdout)
    try:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The pipeline uploads homework answer images to http://notice.chaoxing.com/pc/files/uploadNoticeFile over plain HTTP, exposing authentication cookies, uploaded content, and server responses to interception or modification by a network attacker. In this skill's context, the images contain user homework answers and the session is authenticated, so MITM tampering could leak academic data or hijack the Chaoxing session.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/xuexitong_scan_pending.py (reported line 56)May include surrounding context.

python

env = dict(os.environ)
    env["XUEXITONG_SKIP_UPDATE_CHECK"] = "1"

    return subprocess.check_output(cmd, env=env).decode("utf-8")


def main():

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script reads a cookie from the default credentials path and uses it to authenticate requests, which is a sensitive credential access operation. While the module docstring explains scanning behavior, it does not disclose that authentication cookies will be read from disk and used for network requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script sends authenticated HTTP requests to homework URLs using the user's cookie-backed session, which transmits user/session data over the network. The current description focuses on scanning assignments but does not explicitly warn that authenticated requests will be made to the remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code constructs a requests session that injects the user's Chaoxing cookies into all subsequent HTTP requests, which is a safety-relevant network operation involving credentials. Although the script uses these cookies as part of its function, there is no user-facing disclosure in comments, prompts, or CLI help warning that the provided cookie file will be sent to remote services for authentication.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/xuexitong_submit.py (reported line 70)May include surrounding context.

python

def session(cookie_header: str, ua: str = DEFAULT_UA) -> requests.Session:
    """Create a session that sends cookies as a CookieJar (more reliable than raw Cookie header)."""
    s = requests.Session()
    s.headers.update(
        {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specification uses a lower-bound constraint only (requests>=2.31.0), which allows installation of any future major or minor release. This harms build reproducibility and can unintentionally pull in vulnerable or breaking versions, especially significant for an automation skill that logs into third-party services and handles homework submission workflows over the network.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The manifest does not pin the requests version, so there is no way to verify whether deployment will install a release affected by known advisories. In this skill's context, which appears to interact with remote Chaoxing endpoints and likely handles authentication/session data, an affected requests release could increase the risk of credential leakage, TLS/request-handling flaws, or other client-side security issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The session headers hard-code Accept-Language: zh-CN,zh;q=0.9, which forces a specific language/locale preference for all requests. This is a natural-language policy concern because the file does not offer user opt-in or explain why the locale restriction is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The session headers hard-code Accept-Language to "zh-CN,zh;q=0.9", which forces a specific locale for all requests. The file does not offer a user opt-in or configuration option, and no justification is documented for requiring this locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.