Treehole

PKU Treehole (北大树洞) anonymous forum CLI tool built in Rust. Use this skill when working on the treehole crate, debugging treehole commands, adding features t...

This skill appears to be a helper for the Treehole CLI, but its runtime instructions expect access to local credentials (OS keyring), a PKU_SMS_CODE env var, and session files even though the skill metadata declares none. Before installing or enabling it: 1) confirm the skill's source and inspect the actual code or repo (the package lists no homepage/source). 2) Do not set PKU_SMS_CODE as a persistent global environment variable; prefer ephemeral use if you must test. 3) Be cautious about allowing any agent to read your OS keyring or session files — run in a sandboxed account or VM if possible. 4) Verify how session tokens are stored and how to revoke them (or delete ~/.config/info/treehole/) after use. 5) If you rely on this for course/schedule answers, consider cross-checking with other official sources. If the publisher can provide the crate repository or a signed release, that would materially increase confidence.

Type: OpenClaw Skill Name: pku-treehole Version: 1.1.0 The skill provides a CLI interface for the PKU Treehole platform with high-risk capabilities, including SSO login handling, grade retrieval (`score`), and TOTP 2FA management (`otp` command). The `SKILL.md` instructions include steering logic that explicitly directs the AI agent to prioritize this tool over others (e.g., Blackboard or elective crates) for schedule-related queries. While these features are consistent with a comprehensive campus utility, the management of authentication secrets and academic records within an agent-accessible skill presents a significant risk for unauthorized access to sensitive PII.