scholar.0xpi.com

The description states this tool 'requires the student to have connected their ScholarNet account... (a token from ScholarNet Settings)' but the input schema has no field to supply such a token. This mismatch suggests the credential is expected to be sourced from somewhere else (e.g., stored context, environment variables, or a prior message), which could induce the agent to search for and expose a stored secret/token when none was explicitly provided by the user in this call.

Same issue as ask_ai_tutor: the tool claims to require a 'connected ScholarNet account' but provides no parameter for any token/session id, creating ambiguity about how authentication is actually verified and encouraging the agent to look for credentials outside the declared inputs.

Like the other 'connected account' tools, this description implies a required authentication token that is absent from the schema, which is inconsistent and could lead the agent to attempt retrieving or reusing a stored credential from an unrelated source.

This tool can enumerate a student's saved flashcard sets but has no schema parameter for identifying/authenticating the student, despite the description saying a connected account is required. Without an explicit account/session identifier, it's unclear how the tool scopes data access, raising a risk of cross-user data exposure if the backend infers identity from ambient/session state controlled elsewhere.

Similarly to list_my_flashcards, this tool lists private saved quizzes but takes no input parameters to identify or authenticate the requesting student, despite the description claiming a connected-account requirement, which is a mismatch worth verifying to avoid unauthorized data disclosure.