Course

PKU Teaching Platform (北大教学网/Blackboard Learn) CLI tool built in Rust. Use this skill when working on the course crate, debugging course commands, adding fea...

Security Scan

The skill's text describes a PKU Blackboard CLI and development workflow, but it references reading/writing local credential stores and config paths and expects a local CLI/crate without declaring binaries, installs, or required credentials — an incoherence that could lead to unintended access to your keyring or files.

Purpose & Capability

The SKILL.md describes a Rust CLI (crates/course/, commands like `course login`, `video-download`, etc.) and refers to local source files. Yet the skill declares no required binaries, no install steps, and no required config paths. That mismatch means the skill either assumes the agent already has the course binary and source tree available, or it will attempt runtime actions (login, file access) without making its dependencies/privileges explicit.

Instruction Scope

The instructions explicitly reference running commands (e.g., `course login -p`, `info-auth check`), accessing HTML-scraping code and crate files, and using multipart uploads. They also describe an auth flow and session persistence. These runtime directions imply reading local repo files and invoking binaries that can access user data — scope beyond a simple descriptive skill and not declared in requirements.

Install Mechanism

No install spec is present (lowest install risk). That is safe from a supply-chain viewpoint, but inconsistent with a skill that describes a CLI binary and crate: the SKILL.md assumes the binary/crate exists in the environment but provides no guidance on how to obtain or build it.

Credentials

The doc states credentials are resolved via `info_common::credential` (keyring → env → interactive) and that sessions persist to `~/.config/info/course/`. Yet the skill lists no required env vars or config paths. Asking agents to auto-login using the OS keyring or environment without declaring that need is a disproportionate, undeclared access to sensitive local secrets.

Persistence & Privilege

The skill will persist session state to `~/.config/info/course/` and encourages auto-login behavior. It does not request always: true and doesn't claim system-wide config changes. Persisting its own session is expected for a CLI, but the fact this is not declared in the skill metadata reduces transparency and could surprise users who don't expect local files to be written or keyring access.

What to consider before installing

This skill reads/writes local config and may try to use your OS keyring or environment creds but does not declare those needs. Before installing or invoking it: (1) confirm you have the `course` binary or the repository present and know what exact commands will run; (2) avoid running the skill with automatic keyring access — prefer providing a dedicated test account or entering credentials interactively; (3) inspect the local repo files the skill references (crates/course/) to ensure they are what you expect; and (4) if you don't want new files, monitor or sandbox writes to `~/.config/info/course/`. The inconsistencies could be benign (developer helper) but warrant caution.

Course - 北大教学网 CLI

A CLI client for PKU's Blackboard Learn teaching platform.

Architecture

• Crate location: crates/course/
• Auth flow: IAAA SSO (app_id="blackboard") → Blackboard SSO endpoint callback
• API: HTML scraping with scraper crate (no JSON API available)
• File upload: multipart form via reqwest

Key Source Files

• src/main.rs — Clap CLI with subcommands
• src/commands.rs — Command implementations
• src/api.rs — HTML scraping logic, page parsers
• src/display.rs — Terminal output formatting
• src/client.rs — reqwest client builders

CLI Commands

Command	Alias	Function
login / logout / status		IAAA → Blackboard auth
courses		List enrolled courses (supports --all for all semesters)
info		Course details
content		Browse course content tree
assignments		List assignments with deadlines
assignment		View single assignment
browse		Interactive course content browser
assignment-download	adl	Download assignment attachments
download		Download course files
video-download	vdl	Download course recordings
videos	vls	List available videos
submit		Upload homework files
otp		TOTP 2FA management

Auto-Login for AI Agents

# Check session status
info-auth check

# Auto-login (reads credentials from OS keyring, no password needed)
course login -p

Development Notes

• HTML parsing is the primary data extraction method — no REST API
• Assignment list supports deadline-based sorting
• Video download handles replay/recording URLs
• All user-facing strings in Chinese
• Error handling: anyhow::Result with .context("中文描述")
• Session persisted to ~/.config/info/course/
• Credentials resolved via info_common::credential (keyring → env → interactive)