Security audit

yuketang

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Rain Classroom MCP setup and teaching-data helper, but its installer performs an undisclosed silent reporting call and handles credentials/local configuration in ways users should review first.

Install only if you trust this Rain Classroom MCP endpoint and are comfortable giving it your YUKETANG_SECRET. Treat the secret like a password, avoid pasting it into shared logs or shell history, and review setup.sh before use because it silently reports an install event; prefer a safer installer that avoids shell interpolation and makes telemetry opt-in.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: setup.js:31
Finding: Command Injection Through the YUKETANG_SECRET Environment Variable
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.js:35
Finding: Runtime Download and Execution of an Unverified npm Package
Content: View full analysis
Remediation: View remediation

other

Note

Location: setup.sh:102
Finding: Undisclosed Silent Installation Telemetry
Content: View full analysis
/dev/null 2>&1; then npx mcporter@0.8.1 call yuketang-mcp claw_report \ --args "{\"payload\":{\"durationMs\":${DURATION}},\"action\":\"install\"}" \ >/dev/null 2>&1 || true fi ``` ### Technical Analysis After setup, the shell installer invokes the remote `claw_report` MCP tool and sends an installation action plus the measured installation duration. The request is performed using the configured authenticated MCP service. The reporting behavior is not disclosed in `SKILL.md`. Standard output and error output are redirected away, and failure is ignored with `|| true`, making the network request invisible during normal installation. The observed payload contains installation timing and the action name. The audited client code does not explicitly send other host data in this call. However, the remote service will necessarily receive normal connection metadata, and the request is associated with the configured authentication context. ### Attack Path 1. A user exports `YUKETANG_SECRET` and runs `bash setup.sh`. 2. The installer registers the authenticated MCP endpoint. 3. Setup records its elapsed duration. 4. The installer calls the remote `claw_report` tool with `action` set to `install`. 5. Output and errors are suppressed, so the user receives no visible indication that reporting occurred. 6. The remote service receives the installation event and timing data in the authenticated context. ### Impact Assessment The behavior enables undisclosed tracking of installation events. Its direct payload is limited to installation duration and an action identifier, so the technical impact is lower than arbitrary data exfiltration. Nevertheless, it creates privacy and transparency concerns bec ...[truncated 274 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose presents the skill as a data-query helper, but the instructions also cover secret handling, environment-variable management, local MCP registration, command execution, and immediate validation. This mismatch can mislead users and higher-level policy systems about the real privileges and side effects, increasing the chance of unintended local modification or secret exposure.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill uses sensitive local capabilities around environment variables (YUKETANG_SECRET) but does not declare any explicit tool scope or permission boundary. That creates an authorization gap where an agent may read or influence secrets/configuration without the user seeing a clear capability declaration, which is especially risky because the skill also instructs local setup and verification flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to place a personal secret in environment variables but provides no warning that this is sensitive credential material or that shell history, logs, screenshots, process inheritance, or shared environments may expose it. In a skill that relies on local setup and agent-mediated execution, omission of credential-safety guidance raises the risk of accidental disclosure or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to directly update the user's environment variable after receiving the secret, without clear consent, scoping, or warning about modifying local configuration. This creates a high-risk path for persistent local changes involving credentials, potentially overwriting existing settings, leaking secrets into profiles/config files, or normalizing unsafe secret-handling by the agent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation exposes cube_lesson_reservation, which performs a state-changing scheduling action, while the skill description says it provides account and class query services. This scope mismatch can mislead an agent into invoking a write-capable tool in contexts where only read-only behavior is expected, increasing the risk of unauthorized or unintended class creation or modification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Comments and all user-facing console messages are written in Chinese, and the final usage example instructs the user to speak in Chinese. This imposes a language expectation without any opt-in or explanation that the skill is intentionally Chinese-only for a specific audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script reads a secret from an environment variable and interpolates it directly into a shell command passed to execSync. This can expose the credential through process listings, shell history/logging, CI logs, or shell metacharacter injection if the secret contains unexpected characters, making the setup flow riskier than necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This shell script reads the sensitive YUKETANG_SECRET environment variable and injects it into an Authorization header for the mcporter registration call. Although the script logs setup progress, it does not explicitly disclose to the user that their secret will be sent to a remote MCP endpoint during registration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script performs an additional install-time reporting action (claw_report) that is not necessary for configuring the advertised query service and is executed silently with all output suppressed. Undisclosed telemetry during setup violates user expectations, creates unnecessary outbound communication, and can become a privacy/security issue if the receiving service logs identifiers, timing, or other metadata.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code includes a silent telemetry capability unrelated to the stated purpose of providing Yuketang account/class queries. Because it is hidden behind /dev/null 2>&1 || true, users receive no indication that installation metadata is being transmitted, which increases the risk of covert tracking and weakens informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script makes a silent network reporting call during installation without any user-facing disclosure, and suppresses all output and failures. In a setup script for a classroom query skill, hidden outbound telemetry is not justified by core functionality and may expose usage metadata or facilitate tracking without consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This line forces a specific locale/timezone rule for all users by interpreting dates relative to Beijing time. That is a language/locale policy concern because it does not offer user choice or clearly limit the skill to a region-specific context in this instruction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents all user-facing instructions, examples, and prompts exclusively in Chinese, including required interaction text. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The script invokes an external package through execSync and npx, which executes code and modifies project-scoped configuration. Although the script's purpose is setup, there is no explicit warning that it will run external tooling and change local MCP config, beyond success/failure logs after the fact.
Content: No source excerpt is available for this finding.