Security audit

PKU Claspider

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent read-only PKU course scraper, but it tells users to reuse login sessions and pass a browser JWT on the command line without adequate secret-handling safeguards.

Review this skill before installing if you would use the authenticated sources. Do not paste real JWTs into chat, logs, shared terminals, or shell history; prefer safer credential mechanisms if the implementation supports them, and treat the reused elective session directory as sensitive account material.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:53
Finding: Authentication JWT Exposed Through Command-Line Arguments
Content: View full analysis
info_zhiyun.json # Merge all three sources claspider merge --term 25-26-2 --category speciality --dept 00048 \ --zhiyun-token eyJhbGc... --zhiyun-week 2026-04-13 --json > info_merged.json ``` The command interface is also documented as accepting the credential directly: ```text zhiyun --token --week-start 2026-04-13 [--detail] [--json] ``` ### Technical Analysis The documentation instructs users to copy the `_token` authentication cookie from an active browser session and provide that JWT directly as a command-line argument. Command-line arguments are not an appropriate channel for secrets because they may be exposed through: - Shell history files. - Process inspection utilities and operating-system process interfaces. - Terminal session recording. - Command auditing, telemetry, crash reports, or diagnostic logs. - Wrapper scripts and automation logs that preserve the complete command. Although the displayed value is only a placeholder, users following the documented workflow must replace it with a real bearer token. Possession of such a token may permit another party to issue authenticated requests as the affected user until the token expires or is revoked. The reviewed artifact contains only `SKILL.md`. The underlying Rust implementation was not present, so token redaction, token lifetime, API authorization boundaries, and any additional runtime protections could not be verified. ### Attack Path 1. A user extracts the `_token` JWT from the authenticated `onlineroomse.pku.edu.cn` browser cook ...[truncated 1239 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documentation instructs users to supply a browser JWT token and to reuse an existing login session directory, but it does not explicitly warn that these credentials are sensitive, may grant account access, and should not be pasted into chats, logs, shell history, or shared outputs. In an agent setting, this omission increases the chance of accidental credential disclosure or unsafe handling by downstream tooling, even though the skill itself is presented as read-only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The line states 所有文案中文 ('all text is Chinese'), which is a natural-language policy constraint forcing a specific language. The file does not indicate any user opt-in or alternative locale support, so this matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.