Security audit

Treehole

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only Treehole skill is coherent, but it gives agents broad authenticated PKU account access without clear consent boundaries.

Install only if you trust the local treehole and info-auth binaries and are comfortable letting an agent access your PKU Treehole account. Require confirmation before login, schedule/grade/profile reads, or posting/replying/voting, and log out or clear the saved session when persistent access is no longer needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill’s invocation guidance is overly broad by directing use of the treehole skill for generic schedule and calendar questions, even when the user may not have intended access to Treehole-backed personal data. This can cause an agent to select a credentialed skill in situations where a less-privileged source would suffice, increasing the chance of unnecessary account access and disclosure of sensitive academic information.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill encourages automatic login using stored keyring credentials and an SMS code from an environment variable without requiring an explicit consent or warning that account actions will occur. In an agent setting, this lowers the barrier to silently authenticating to a real user account and accessing protected data, which is especially risky because SMS verification is also automated.

Static analysis

No suspicious patterns detected.