Skills/npm/dsh-zju-lecture-note

dsh-zju-lecture-note@2.2.8

CAUTION· startup only

Publisher claims: "浙大智云课堂回放讲义插件（DeepSeek Harness 原生插件）：以「语音字幕 + 本地课件」为主链路，写完讲义自动排版同名 PDF；可选启用投影 PPT 截图抓取、基于 Typst scholia 模板排版的填空式学习笔记与登录辅助工具；一键登录窗口让用户正常登录后把登录态加密保存到平台凭据库（Windows DPAPI / macOS 钥匙串 / Linux 密钥环，无可用凭据库时不落盘），不回显、不进入对话、不保存密码" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher chenqianyu486-sys · publishing for 11 daysInstalls 1,044Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-08 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimedstartup only: exited (0) before answering · at importDependency (file:///tmp/ks-detonate-TI37tn/task/home/work/acme-api/.claude/skills/scholia-notes/lib/index.js:67:13) at process.processTicksAndRejections (node:internal/process/task_queues:103:5) at async file:///tmp/ks-detonate-TI37tn/task/home/work/acme-api/.claude/skills/scholia-notes/lib/index.js:76:29 Node.js v22.23.4
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedzju_lecture/cookies.py:150 · Python subprocess execution detectedraw = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with suspicious TLDlib/client.js:187 · URL with suspicious TLD — commonly used for phishing/malwareenvMirrorPlaceholder: 'https://ghfast.top/',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDlib/client.js:268 · URL with suspicious TLD — commonly used for phishing/malwareenvMirrorHint: 'GitHub Release 前缀，例如 https://ghfast.top/。',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDlib/client.js:269 · URL with suspicious TLD — commonly used for phishing/malwareenvMirrorPlaceholder: 'https://ghfast.top/',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandlib/bridge.js:489 · Process kill command — agent can terminate processes// timeout used to kill the process and with it the in-memory cookieFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathszju_lecture/security.py:187 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"^\.env($|\.)",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedzju_lecture/cookies.py:163 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedzju_lecture/browser_login.py:744 · Python subprocess execution detectedreturn subprocess.Popen(args, **kwargs)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathszju_lecture/security.py:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"^\.netrc$", r"^\.npmrc$", r"^\.pypirc$",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedzju_lecture/credential_store.py:226 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedzju_lecture/deps.py:223 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandzju_lecture/cookies.py:386 · Process kill command — agent can terminate processesor a ``kill -9`` between the copy and the cleanup can leave a plaintextFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with suspicious TLDlib/index.js:239 · URL with suspicious TLD — commonly used for phishing/malware"Typst 下载镜像前缀（默认留空）：例如 https://ghfast.top/；自动安装 Typst 时加在"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDlib/client.js:186 · URL with suspicious TLD — commonly used for phishing/malwareenvMirrorHint: 'Prefix for the GitHub release URL, e.g. https://ghfast.top/.',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsskills/zju-lecture-summarizer/SKILL.md:365 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- `zju_extract_courseware` / `zju_check_note` **只用于课件与讲义**；不要用它们读取 `.ssh`、`.env`、浏览器数据、Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with suspicious TLDzju_lecture/deps.py:16 · URL with suspicious TLD — commonly used for phishing/malware``ZJU_TYPST_MIRROR`` 加前缀走镜像（例如 ``https://ghfast.top/``），Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedzju_lecture/study_notes.py:2539 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈7,401 tok
4 files · 65 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for dsh-zju-lecture-note@2.2.8 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim chenqianyu486-sys: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. URL with suspicious TLD≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim chenqianyu486-sysPropose a patch to the maintainer