Xuexitong Homework Submit

学习通/超星作业自动化（v1.1.2）：扫描作业、抓题模板、暂存/交卷、手写图答案流水线。致谢 HandWrite、学习通 API（mooc1-api.chaoxing.com）与超星图床上传接口（notice.chaoxing.com）。

This skill appears coherent with its stated purpose, but review these points before installing/using it: - Authentication: the scripts require a Chaoxing session cookie file (default ~/.openclaw/credentials/xuexitong_cookie.txt). That file effectively grants access to your account — only use a cookie from an account you trust (consider a throwaway/test account). - HandWrite dependency: rendering handwritten PNGs depends on a local HandWrite project and its virtualenv (.venv). The skill will call that venv's python via subprocess; ensure the HandWrite code is trusted and available at the expected path or adjust the script. - Network calls: the code contacts mooc1-api.chaoxing.com and posts images to notice.chaoxing.com; it also optionally checks GitHub for updates. These are expected but review any corporate/network policy implications. Note: the upload endpoint in code uses plain HTTP (http://notice.chaoxing.com/...), which could expose uploads and any cookies in transit if network paths are untrusted — prefer HTTPS or verify your network is secure. - Final submit is guarded: the script requires an explicit --confirm to perform final submission. Prefer running 'save' (temp-save) first and inspect results before submitting. - Audit & test: since the skill runs subprocesses and performs writes/HTTP requests, inspect the included scripts yourself and test with a non-critical account if possible. If you rely on this in production, consider reviewing the full codepaths that build submission payloads and the exact cookie contents used. If you want additional assurance, provide the full trailing parts of the truncated scripts (the submission payload assembly and any remaining code) so I can verify there are no hidden network endpoints or unexpected behaviors.

Type: OpenClaw Skill Name: xuexitong-homework-submit Version: 1.1.2 The skill bundle is designed for legitimate homework automation on the Chaoxing platform, interacting with its APIs and handling user cookies as expected. However, the `scripts/update_check.py` script performs a remote version check against `raw.githubusercontent.com/smallwhiteman/xuexitong-homework-submit-skill/main/VERSION`. While this script only informs the user of updates and does not auto-execute remote code, it introduces a supply chain risk. A compromise of the GitHub repository could lead to users being prompted to update to a malicious version via `clawhub update`, making this a risky capability without clear malicious intent in the current code.