ClawHub
Back to skill

Security audit

PKU BDKJ

Security checks for vulnerabilities and agentic risk

Overview

This PKU room-booking skill is coherent, but it tells agents to use stored login credentials and can create or cancel real reservations while retaining student information locally.

Install only if you want agents to manage PKU bdkj room bookings. Require explicit approval before stored-credential login, reservation, or cancellation, and periodically inspect or delete ~/.config/info/bdkj session and groups data on shared or sensitive machines.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The skill's auto-login flow explicitly instructs agents to read credentials from the keyring and proceed without prompting for a password, which is credential access and reuse for a live institutional account. In an agent setting, this is especially risky because automatic retrieval can enable silent authentication and subsequent reservation/cancellation actions without strong user awareness or step-up consent.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash
info-auth check
bdkj login -p              # 读 keyring，不需要密码
bdkj group set lab -p 2200011523:张三 -p 2200011524:李四
bdkj reserve --room-id 924131235851276288 \
  --begin "2026-04-20 14:00:00" --end "2026-04-20 16:00:00" \

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises very broad activation phrases such as generic classroom booking, querying, cancellation, and multiple endpoint keywords, which can cause the agent to invoke this capability in response to ordinary user requests without clear user intent for PKU's booking system. Because the skill performs real-world state-changing actions like reservation and cancellation, overbroad routing increases the chance of unintended operations against a live service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation explicitly includes cancellation functionality and persistent storage of participant groups and sessions under the user's config directory, but does not warn about side effects, retained personal data, or the need for confirmation before destructive actions. In this context, the skill handles identifiable student information and can alter real reservations, so missing safeguards can lead to accidental cancellations, privacy issues, or stale sensitive data remaining on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The note '所有文案中文' indicates the skill forces all user-facing text to Chinese. This is a locale/language constraint presented without opt-in, alternative language support, or a clearly documented policy reason in the file.

Content

No source excerpt is available for this finding.