Security audit

yuketang-mcp

Security checks for vulnerabilities and agentic risk

Overview

This Rain Classroom skill is mostly legitimate, but its setup has under-disclosed credential and install-reporting behavior that users should review before installing.

Install only if you trust the Rain Classroom/XuetangX MCP endpoint and are comfortable granting it access to your account and class data. Review setup.sh before running it because it silently reports an install event, protect and rotate YUKETANG_SECRET if exposed, remove the MCP config when no longer needed, and approve class reservations only after checking the class, time, title, duration, and meeting type.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill relies on an environment variable (`YUKETANG_SECRET`) for authentication and instructs the agent to read and update it, but the skill metadata does not declare permissions or clearly scope this capability. This creates a transparency and least-privilege problem: users and hosting platforms may not realize the skill can access sensitive local credentials.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared purpose is data/query assistance, but the installation flow also instructs configuration of an MCP service, local client modification, secret handling, service validation, and possible telemetry/reporting behavior not disclosed in the description. This mismatch is dangerous because users may consent to a harmless-looking query skill without understanding that it changes local configuration and interacts with remote services using their credentials.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The reference file documents an action-capable tool (`cube_lesson_reservation`) that can schedule classes, while the declared skill scope says the skill only provides account and class query services. This mismatch expands the effective permission surface and can mislead reviewers, orchestrators, or users into allowing unintended state-changing operations, creating a capability-confusion risk.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script reads YUKETANG_SECRET from the environment and interpolates it directly into a shell command passed to execSync. If the secret contains shell metacharacters or attacker-controlled content, this can lead to command injection or unintended command behavior, and it also expands the exposure of a bearer credential in process arguments and logs. In this skill's context, the manifest describes query functionality, so a setup-time capability that shells out with a credential is broader and riskier than necessary.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The setup script performs a silent post-install network call (`claw_report`) that is not disclosed in the skill description, which only claims account and class query functionality. Undisclosed telemetry during installation violates user expectations, can leak metadata such as installation timing and usage context, and creates an unnecessary outbound communication path.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The installation telemetry capability is unrelated to the stated purpose of querying Yuketang account and class information. Adding silent reporting expands the skill's behavior beyond its declared scope, increasing privacy and trust risk because users would not reasonably expect install-event reporting from a query-only integration.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill asks the user to obtain a personal secret and states that, once provided, the agent should directly update environment variables for them, without any warning about credential sensitivity, masking, secure storage, or chat/log exposure. This increases the risk of accidental secret disclosure in conversation history, shell history, screenshots, or unsafe persistence mechanisms.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script sends telemetry silently by redirecting all output to `/dev/null` and not warning the user that an install event is being reported. This prevents informed consent and impedes review of what data is transmitted, which is especially concerning in a setup script that already handles a bearer secret for an external service.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: setup.js:35