Security audit

learn-courses-mooc

Security checks for vulnerabilities and agentic risk

Overview

This skill automates logged-in MOOC course activity and can auto-click or dismiss prompts, which may affect a user's account or course records without enough safeguards.

Review this carefully before installing. It is not just a video helper: it can operate a logged-in MOOC account, click course controls, close prompts, and create local learning history files. Use it only where you are authorized and where automated course completion does not violate platform rules, employment requirements, academic-integrity rules, or compliance obligations. Prefer running it in a limited browser profile/account and avoid using it on unrelated tabs or sensitive sessions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/learn-courses.js:201
Finding: Unrestricted Automatic Confirmation of Page-Controlled Dialogs
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package.json:9
Finding: Non-Reproducible Dependency Installation Using Floating Package Versions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
编辑 `scripts/learn-courses.js`，在 `CONFIG.COURSES` 数组中添加目标课程：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
编辑 `scripts/learn-courses.js`，在 `CONFIG.COURSES` 数组中添加目标课程：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly advertises '弹窗智能处理 - 自动关闭学习过程中的确认弹窗' but does not clearly warn users that on-screen dialogs will be dismissed automatically. This can hide important consent, policy, payment, or integrity prompts and may cause the automation to take actions the user did not meaningfully review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx playwright install chrome without pinning a specific Playwright version. This makes the installation non-reproducible and exposes users to supply-chain risk if a newer or compromised package version is fetched at execution time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README describes an automation flow that logs into a MOOC platform, detects required chapters, and automatically completes video learning, but it does not clearly warn about account sanctions, policy violations, or platform abuse implications. In this context, the skill is specifically designed to simulate course completion activity, which makes the omission more dangerous because it can facilitate unauthorized or deceptive platform interactions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The troubleshooting guidance again tells users to run npx playwright install chrome without a pinned version. Repeating unpinned package execution increases the chance of fetching unexpected code and normalizes unsafe installation practices for end users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script deliberately generates synthetic clicks at randomized intervals to prevent idle detection rather than merely waiting for playback to finish. In the context of a MOOC automation tool, this is dangerous because it falsifies user presence, can bypass platform engagement controls, and may trigger unintended actions on whatever page is active at the time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script launches a browser session and proceeds to automatically navigate courses, start learning, click controls, and dismiss dialogs, while only presenting operational instructions rather than a clear warning about these side effects and their implications. This is risky because users may not understand that the tool will autonomously interact with course pages, potentially acknowledge prompts, alter progress state, or perform actions in the wrong tab.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill writes persistent files ('learning-progress.json' and 'learning-report.json') but does not clearly warn users about local data persistence. Undisclosed file creation can expose course activity history, identifiers, or usage metadata to other local users/processes and may surprise operators in shared or sensitive environments.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency uses a caret range (^1.40.0), which allows installation of different future patch and minor releases instead of a single reviewed version. In an automation tool that drives a browser, this weakens supply-chain control and can unexpectedly introduce vulnerable or malicious dependency updates into the skill environment.
Content: Scanner excerpt · assets/package.json (reported line 10)May include surrounding context.
json
"start": "node scripts/learn-courses.js" }, "dependencies": { "playwright": "^1.40.0" } }

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: The manifest references Playwright without pinning an exact version, so it is not possible to verify whether the resolved package is affected by the cited advisory about downloading/installing browsers without authenticity verification. This is more concerning in this skill because its purpose is browser automation, so the package is central to execution and may trigger browser downloads during setup or runtime.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description is written only in Chinese ("MOOC自动化学习工具"), which can be interpreted as a language-specific presentation without any documented user opt-in or justification. Under the policy, locale or language constraints should either be optional for users or clearly documented as intentionally region-specific.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: The dependency uses a caret range (^1.40.0), which allows newer minor/patch releases to be installed without explicit review. This weakens build reproducibility and can unexpectedly pull in a vulnerable or malicious upstream release, which is more concerning here because the skill relies on a browser automation framework that executes complex external tooling.
Content: Scanner excerpt · package.json (reported line 10)May include surrounding context.
json
"start": "node scripts/learn-courses.js" }, "dependencies": { "playwright": "^1.40.0" }, "keywords": ["mooc", "自动化", "学习", "playwright"], "author": "",

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 73% confidence
Finding: The manifest includes Playwright, which has a noted advisory related to browser downloads/authenticity verification, but the dependency is not pinned, so the actually installed version cannot be verified from this file alone. In this skill's context, automated browser installation and execution increases supply-chain risk because compromised browser binaries could affect the host running the automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: All user-facing banners, instructions, prompts, and status messages are hard-coded in Chinese, and the script does not offer any language selection or opt-in. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.