Security audit

Tronclass Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-built for TronClass LMS automation, but it asks an agent to handle real account sessions, passwords, downloads, and homework submissions with overly broad activation and weak install/credential safeguards.

Review this carefully before installing. Use it only for TronClass/FJU accounts you intend the agent to access, avoid giving passwords in chat or command-line arguments, prefer interactive login where possible, verify course IDs and file paths before downloads or submissions, and pin or independently review the tronclass-cli package version before installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Unpinned Global Installation of an External CLI Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/auth.md:25
Finding: LMS Password Exposed Through Command-Line Arguments
Content: View full analysis
``` ``` `references/auth.md:33-46`: ```markdown ### 3. Deferred-CAPTCHA (FJU, for agents) Two-step flow for agents that cannot solve the CAPTCHA inline. The password is **never persisted** — it is supplied only at resume time. ```bash # Step 1: parse the form, download the CAPTCHA image, save pending state. # Exits 0 and prints a captcha ID. No password requested. tronclass auth login --fju --non-interactive # Step 2: supply the password and the solved CAPTCHA code. tronclass auth captcha --password '' ``` ``` `references/auth.md:57-72`: ```markdown ## Captcha ```bash tronclass auth captcha --password ``` Completes a pending FJU login that was paused on a CAPTCHA challenge. - `` — the captcha ID printed by `auth login --fju --non-interactive`. - `` — the characters read from the saved CAPTCHA image. - `--password ` — the user's password (not stored from step 1). On success, the pending-state file and CAPTCHA image are removed and the session is saved as usual. On failure (wrong code, expired state, network error), the pending state is also cleared (the CAS `execution` token is single-use) — the caller must re-run `auth login --fju --non-interactive` to start over. ```bash tronclass auth captcha --password 'my_password' abc123def456 3xyz ``` ``` ### Technical Analysis The documented non-interactive authentication flows place the user's LMS password directly in ...[truncated 2358 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description instructs activation for broadly defined 'school' or 'assignment' requests even when the user does not explicitly mention TronClass. That can cause the agent to invoke this skill for unrelated education contexts and potentially access, reveal, download, or modify a user's live LMS data without sufficiently clear intent tied to TronClass.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README explicitly encourages workflows that upload local files and perform remote actions in a live LMS account, but it does not warn that these operations can modify course state, submit the wrong file, or disclose local documents if the agent misinterprets a prompt. In an agent-driven context, this omission is security-relevant because users may not realize that natural-language requests can trigger real submissions or downloads against sensitive academic data.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- **Authentication**: Most commands require a saved session. If a command fails, tell the user to run `tronclass auth login <username>`. The session is reused automatically; `tronclass auth check` probes a live TronClass endpoint to confirm whether it's still valid. - **FJU users**: Use `tronclass auth login --fju <student_id>` for the CAS flow with CAPTCHA support. - **Non-interactive login (agents/scripts)**: Pass `--password <p>` (and `--base-url <u>` for generic deployments) to skip prompts. For FJU, where a human must solve the CAPTCHA, use the two-step deferred flow: `tronclass auth login --fju --non-interactive <user>` prints a captcha ID and opens the captcha image; then `tronclass auth captcha --password <p> <captcha_id> <code>` completes the login. The password is never written to disk — it is supplied only at resume time. - **Finding IDs**: The typical lookup chain is `courses list` → `activities list <course_id>` → `activities view <activity_id>`. The `todo` command shows activity IDs directly in the first column. - **Aliases**: `activities` → `a`, `courses` → `c`, `homework` → `hw`/`h`, `todo` → `td`/`t`, `announcements` → `ann`. Subcommands also have short aliases (`list`→`l`/`ls`, `view`→`v`, `download`→`d`/`dl`, `submit`→`s`).

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The workflow demonstrates final homework submission as a routine command sequence without a prominent warning that it changes the user's official LMS record. In an agent setting, this increases the risk of unintended real-world actions such as accidental submission of the wrong file or premature finalization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation explicitly demonstrates supplying passwords as command-line arguments, which commonly exposes secrets via shell history, process listings, audit logs, or orchestration metadata. In an agent-oriented skill, this is more dangerous because automated systems may routinely construct and log full commands, causing credential leakage beyond the local terminal session.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The status field is documented as using Chinese labels only, which may impose a specific language/locale without user opt-in. The file does not mention that this is locale-specific, configurable, or intentionally limited to a particular audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file documents a command that saves downloaded content to a local path, which can affect user data and filesystem state. While it explains where files are saved, it does not include a user-facing warning about the write operation or advise caution when specifying output paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: SQP-3 applies to natural-language policy issues across all file types, including locale constraints. The sentence fixes date formatting to Taiwan locale and does not mention configurability, user preference, or a documented region-specific justification, which can violate language/locale choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file documents that ann download saves a file to ~/Downloads/<filename> when no output path is provided, which is a user-data-affecting file write. Although the behavior is described, there is no explicit warning or cautionary note about writing to disk or overwriting/where files will be stored, which is the kind of disclosure SQP-2 asks for in markdown skill descriptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file documents local storage of cookies, config, student/account metadata, and pending authentication state without clearly warning that these artifacts are sensitive and should be protected. Although some permissions are mentioned for pending CAPTCHA state, the broader session storage description may lead users or agent implementers to back up, share, or expose ~/.tronclass-cli/ contents, enabling session hijacking or privacy leakage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file hardcodes user-facing status labels such as 已繳交, 草稿, 待繳交, and 未繳 without indicating that the skill is intentionally Chinese-only or giving users a language option. This can violate language/locale policy when a specific language is imposed without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation states that rendered homework status is shown using Chinese labels only. Because no language choice or locale justification is provided in the file, this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The --raw option is documented as printing raw JSON from underlying endpoints, including a resolved user_id and submission-related data. This exposes potentially sensitive account and coursework information, but the reference text does not warn users about privacy implications or advise caution when sharing terminal output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.