Xuexitong Homework Submit

• Analyzed: May 14, 2026, 4:35 AM
• Findings: 1
• Version: 1.1.2
• Hash: a19bf41777f434523ee2c656fd98261fd06d0a2125015d1d7d8c9e54ae457343
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for legitimate homework automation on the Chaoxing platform, interacting with its APIs and handling user cookies as expected. However, the `scripts/update_check.py` script performs a remote version check against `raw.githubusercontent.com/smallwhiteman/xuexitong-homework-submit-skill/main/VERSION`. While this script only informs the user of updates and does not auto-execute remote code, it introduces a supply chain risk. A compromise of the GitHub repository could lead to users being prompted to update to a malicious version via `clawhub update`, making this a risky capability without clear malicious intent in the current code.