Security audit

yuketang-club-liuxinghui

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Rain Classroom connector, but its setup and disclosure around credentials, installation commands, and reporting need careful review before use.

Install only if you intend to give this skill access to your Rain Classroom account, including class, teaching, student-warning, homework, notice, and lesson-reservation workflows. Prefer not to run the included setup scripts until mcporter is pinned, secrets are not passed on command lines, and the silent install report is removed or made opt-in; use a scoped, revocable secret and inspect generated MCP config for plaintext credentials.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: setup.js:27
Finding: Shell Command Injection Through YUKETANG_SECRET
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.sh:46
Finding: Unpinned Third-Party Package Execution During Installation
Content: View full analysis
&1 | grep -q "yuketang-mcp"; then echo "✅ 验证通过" npx mcporter list | grep -A 1 "yuketang-mcp" || true ``` ```bash npx mcporter call yuketang-mcp claw_report \ --args "{\"payload\":{\"durationMs\":${DURATION}},\"action\":\"install\"}" \ >/dev/null 2>&1 || true ``` ### Technical Analysis Both installation paths execute `mcporter` through `npx` without an exact version, local locked dependency, or verified integrity value. The project has no dependency lockfile establishing which package artifact was reviewed. If the package is absent locally, `npx` can retrieve executable package code at installation time. The effective code therefore may change after this Skill has been audited. That package executes with the user's privileges and can inherit or otherwise access the installation environment, including `YUKETANG_SECRET`. ### Attack Path 1. A malicious release is published under the expected package name, or the legitimate package or registry account is compromised. 2. A user runs `setup.js` or `setup.sh`. 3. `npx mcporter` resolves and retrieves the current package version rather than an audited immutable artifact. 4. Package installation hooks or runtime code execute locally. 5. The ...[truncated 512 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: setup.sh:43
Finding: Bearer Credential Exposed Through Process Arguments
Content: View full analysis
Remediation: View remediation

other

Note

Location: setup.sh:99
Finding: Undisclosed Silent Installation Telemetry
Content: View full analysis
/dev/null 2>&1; then npx mcporter call yuketang-mcp claw_report \ --args "{\"payload\":{\"durationMs\":${DURATION}},\"action\":\"install\"}" \ >/dev/null 2>&1 || true fi ``` ### Technical Analysis The shell installer makes an authenticated remote call to `claw_report` after setup. The transmitted payload contains an installation action and installation duration. The command deliberately suppresses standard output and standard error and ignores failure. The reviewed `SKILL.md` installation instructions do not disclose this reporting operation or provide an opt-out. The equivalent Node.js setup path does not perform the report, making behavior inconsistent across platforms. No evidence was found that this specific payload transmits files, environment contents, or the secret itself. The security and privacy issue is the undisclosed remote side effect and use of an authenticated service call. ### Attack Path 1. A user follows the documented macOS or Linux installation instructions and runs `bash setup.sh`. 2. The script records the setup duration. 3. After MCP registration, it invokes the remote `claw_report` tool using the configured authenticated MCP service. 4. The installation action and duration are transmitted. 5. Output and failures are suppressed, so the user receives no visible indication that reporting occurred. ### Impact Assessment The remote service learns that an installation occurred and receives its measured duration, potentially associating this event with the account represented by the bearer credential. The reviewed payload has limited sensitivity, so the direct impact is primarily privacy loss, lack of informed consent, and an unnecessary authenticated network operation rather tha ...[truncated 51 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A second aspect of the same mismatch is that the skill appears to be a teaching-data assistant with authenticated external access, not a harmless test skill. Mislabeling security-relevant behavior makes phishing-style social engineering easier and can hide telemetry, configuration, and network reach from users and platform reviewers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A second aspect of the same mismatch is that the skill appears to be a teaching-data assistant with authenticated external access, not a harmless test skill. Mislabeling security-relevant behavior makes phishing-style social engineering easier and can hide telemetry, configuration, and network reach from users and platform reviewers.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file presents itself as a simple summary-related skill, but the actual instructions support authenticated access to teaching, classroom, and student-warning data plus class-management actions such as lesson reservation. This is dangerous because deceptive or incomplete identity in the manifest reduces scrutiny and could trick users into granting access to sensitive educational data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata says it is a 'test for summary', but the referenced documentation enables operational actions like scheduling classes and querying class-specific assignment and announcement data. This capability mismatch can mislead reviewers, users, or policy gates into granting a skill broader privileges than expected, increasing the risk of unauthorized or unexpected actions on educational resources.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script executes external commands via child_process.execSync to configure tooling, despite the stated skill context not justifying command execution. In a misleading or weakly documented skill, arbitrary subprocess execution materially increases risk because it can run fetched code, alter local configuration, and expose the host environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The declared skill purpose is merely 'test for summary', but the code actually requests a secret and registers a remote MCP service. This mismatch is dangerous because it can mislead reviewers and users about the script's real capabilities, reducing informed consent around remote connectivity and credential use.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata says it is a summary-related skill, but the setup script actually configures authenticated access to an external YuKeTang MCP service and sends installation telemetry. This mismatch is dangerous because it can mislead users and reviewers into granting secrets and network access under false expectations, reducing informed consent and increasing the chance of unauthorized data exposure.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill requests use of an environment secret and setup scripts but does not declare any explicit tool scope or permissions boundary. This creates hidden capability risk: reviewers and users cannot easily tell that the skill depends on sensitive credentials and external setup behavior, increasing the chance of over-trust and unsafe installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill tells users to store a personal secret in an environment variable but gives no warning about shell history, process inspection, shared environments, CI leakage, or accidental disclosure in logs. Because this secret appears to authenticate access to user and classroom data, poor handling could expose sensitive account access beyond the intended user.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction says all relative time handling must use current system Beijing time as the baseline, which imposes a specific locale/timezone policy. Because the file does not offer the user a choice or clearly justify that the skill is limited to a Beijing-time operational context, this is a natural-language locale policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill recommends running npx mcporter without pinning a version, which can fetch and execute whatever package version is current at install time. This is a supply-chain risk because a compromised or malicious upstream release could execute arbitrary code on the user's machine during setup or operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document is entirely written in Chinese and all prescribed user-facing prompts and examples are Chinese-only, such as the required clarification messages at L026, L031, L073, and L075. This creates a natural-language locale constraint without any stated option for the user to choose another language or opt in to Chinese-only behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script reads YUKETANG_SECRET for authentication even though the stated skill description does not indicate any need for credentials. This is risky because undisclosed secret collection in a setup flow can normalize credential exposure and cause users to provide sensitive tokens without understanding the purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The bearer token is embedded directly into a subprocess command line via the --header argument. Command-line arguments may be visible to other local processes, shell history, logs, process monitors, or debugging tools, creating a practical credential leakage path even if the script itself does not print the secret.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The script invokes npx mcporter without pinning an exact package version, so execution may fetch and run whatever version is current in the registry at runtime. In a setup script that also handles authentication material and modifies MCP configuration, this creates a supply-chain execution risk if the package is updated maliciously or unexpectedly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The verification step again runs npx mcporter without a pinned version, which can trigger untrusted code resolution at runtime even though it is only checking configuration. This repeats the same supply-chain exposure and broadens the attack surface during installation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script requires YUKETANG_SECRET and uses it to configure an Authorization header for a remote service, even though the declared skill purpose is only 'test for summary'. In this context, collecting and operationalizing a bearer secret is unjustified and increases the risk that users provide sensitive credentials to a skill whose stated purpose does not warrant privileged remote access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script silently reports installation telemetry (claw_report with duration and action) to the remote MCP service without user-facing disclosure or consent. Hidden outbound reporting is dangerous because it normalizes covert network behavior, undermines user trust, and could be expanded to transmit more sensitive data in future revisions with little visibility.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: A silent network reporting call that is suppressed with >/dev/null 2>&1 || true prevents the user from seeing that telemetry occurred or failed. This is dangerous because it obscures outbound communication and makes unauthorized or unexpected reporting harder to detect, especially in a setup script that already asks for a bearer secret.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script's comments and console messages are entirely in Chinese, including the final suggested prompt for interacting with the AI. This imposes a specific language on users without opt-in or any documented locale constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script's user-facing messages and final usage instruction are entirely in Chinese, including the suggested phrase the user should say to the AI. The policy requires flagging language/locale constraints when a skill forces a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.