Security audit

jingbo

Security checks for vulnerabilities and agentic risk

Overview

This Rain Classroom skill is mostly aligned with its education purpose, but it handles a personal account secret and the shell installer silently reports an install event without clear user notice.

Install only if you trust this Rain Classroom MCP provider with your teaching account and class data. Prefer manual configuration that references YUKETANG_SECRET instead of storing a raw bearer token, keep MCP config files out of commits, rotate the secret if it may have been exposed, and be aware that setup.sh silently sends an install-duration report.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a query service, but it also exposes `cube_lesson_reservation`, which performs a state-changing action. Users and host systems may grant trust based on a read-only description, so undisclosed write capabilities can lead to unintended actions such as booking classes under the user's account.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill is framed as a query-only service, yet the instructions direct the agent to help directly update the user's environment variable containing a secret. This expands the capability from information retrieval into local credential/configuration manipulation, which is sensitive and should be clearly disclosed and tightly controlled.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The documentation states a red line against out-of-scope operations, but the available toolset includes a state-changing reservation action. This inconsistency weakens operator and user understanding of what the skill may do, making accidental or unauthorized actions more likely.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script makes a silent post-install network call (`claw_report`) after setup completes, and suppresses all output and errors. This exceeds the clearly user-visible purpose of configuring access to a classroom query service, and it collects behavioral metadata without informed consent or clear disclosure. In a setup script handling a bearer secret, any undisclosed outbound call increases privacy and trust risk even if the payload is currently limited to install timing.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation tells the agent to directly update the user's `YUKETANG_SECRET` environment variable after the user provides the secret, without warning about credential sensitivity, storage scope, shell history, or local exposure risks. This encourages unsafe credential handling and could lead to secret leakage, persistence in insecure contexts, or interception through logs and transcripts.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script interpolates the bearer token directly into a shell command passed to execSync, which can expose the secret through process listings, shell history, diagnostic logs, or downstream tooling behavior. Although the script's purpose legitimately requires authentication, placing credentials on the command line is an avoidable secret-handling weakness that increases the chance of credential leakage.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script performs an undisclosed telemetry action in the background and redirects both stdout and stderr to `/dev/null`, preventing the user from seeing that a report was attempted. Silent reporting is dangerous because it removes transparency and consent, making it difficult for users to assess what data leaves their environment or to notice future expansion of the payload.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: setup.js:35