buaa-classroom-summarizer

Warn

Audited by Socket on Sep 21, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/extract_buaa_classroom.py

The code appears to be a legitimate BUAA classroom extraction utility, not malware. However, it handles highly sensitive browser credentials: it decrypts local cookies, derives a bearer token, and stores plaintext cookies and authorization data in a reusable cache. The cache and temporary cookie copy should be protected with restrictive permissions, minimized, and preferably replaced with an OS-secure credential store or short-lived session handling. Use is unsafe on shared or compromised systems until this credential-storage issue is addressed.

Confidence: 97%Severity: 78%
Audit Metadata
Analyzed At
Sep 21, 2026, 04:01 AM
Package URL
pkg:socket/skills-sh/1xiaoooo%2Fbuaa-course-skills%2Fbuaa-classroom-summarizer%2F@f9f9207535b2698efdd5c817f3a9cf297af48d46b8fbac68cd24085f400f4673