PKU Campus Card

PKU Campus Card (校园卡) CLI tool built in Rust. Use this skill when working on the campuscard crate, debugging campus card commands, adding features, or when t...

Security Scan

The skill's instructions, required access, and persistence behavior are coherent with a CLI developer tool for the PKU campus card; it does access local credentials and a per-user config directory which is expected but sensitive.

Purpose & Capability

The SKILL.md describes a Rust CLI for PKU campus card operations and debugging (auth flows, mobile UA, http1_only, commands, session storage). References to the keyring, environment vars, and ~/.config/info/campuscard/ are appropriate for a CLI that performs login and persists sessions. There is no unexpected cloud credential or unrelated service access requested.

Instruction Scope

The runtime instructions explicitly mention auto-login that 'reads credentials from OS keyring' and commands that persist session state; these actions are within the tool's stated purpose but involve sensitive local secrets. The instructions do not direct the agent to read unrelated system files or exfiltrate data to non-Synjones endpoints, but they do assume access to the user's keyring and environment for credential resolution.

Install Mechanism

This is an instruction-only skill with no install spec and no code files shipped in the skill bundle, so nothing is downloaded or written by the skill installer itself. That reduces install-time risk.

Credentials

No required env vars are declared, but SKILL.md documents credential resolution order: keyring → env → interactive. This is proportionate to a CLI that can auto-login, but it does mean the agent may read environment variables and the OS keyring at runtime. No unrelated secrets or multiple external service credentials are requested.

Persistence & Privilege

The skill persists session data to ~/.config/info/campuscard/, which is consistent with a CLI session cache. The skill is not marked 'always:true' and does not request system-wide modifications or other skills' configs.

Assessment

This skill appears to be what it says: a developer-focused CLI for PKU campus card operations. Before installing or using auto-login, be aware it will read credentials from your OS keyring (and may fall back to environment variables) and will store session tokens under ~/.config/info/campuscard/. Only enable auto-login if you trust the skill source and the agent; otherwise run login commands interactively and inspect or delete ~/.config/info/campuscard/ after use. Because the skill bundle contains only instructions (no shipped code), consider reviewing the actual campuscard crate source (or obtaining the binary from a trusted build) before granting the agent permission to execute login or network actions.

Campuscard - 北大校园卡 CLI

A CLI client for PKU's campus card system (Synjones platform at bdcard.pku.edu.cn).

Architecture

• Crate location: crates/campuscard/
• Auth flow: IAAA SSO (app_id="portal2017") → portal → berserker-auth → JWT
• API: JSON REST with synjones-auth header
• Constraints: Requires mobile UA (PKUANDROID) and http1_only() (server rejects HTTP/2)

Key Source Files

• src/main.rs — Clap CLI with subcommands
• src/commands.rs — Command implementations
• src/api.rs — API client with synjones-auth header injection
• src/display.rs — Terminal output, QR code rendering
• src/client.rs — reqwest client with mobile UA and HTTP/1.1 enforcement

CLI Commands

Command	Alias	Function
login / logout / status		IAAA → portal → berserker → JWT
info		Card balance and details
pay		Display payment QR code in terminal
recharge		Top up card balance
bills	ls	Transaction history (pagination, monthly filter)
stats		Monthly spending statistics
otp		TOTP 2FA management

Auto-Login for AI Agents

# Check session status
info-auth check

# Auto-login (reads credentials from OS keyring, no password needed)
campuscard login -p

Development Notes

• The auth chain is the most complex: IAAA → portal → berserker-auth → JWT token
• Must use mobile User-Agent (PKUANDROID) or requests will be rejected
• Must use http1_only() — the Synjones server does not support HTTP/2
• QR code for payment displayed via info_common::qr (viuer or system viewer)
• All user-facing strings in Chinese
• Error handling: anyhow::Result with .context("中文描述")
• Session persisted to ~/.config/info/campuscard/
• Credentials resolved via info_common::credential (keyring → env → interactive)