三剪客 · 国产大模型一键调用统一路由

• Outcome: Review
• Latest audit: Sep 24, 2026 · 3:28 AM UTC
• Version: 1.1.0

Overview

The skill mostly matches its AI-gateway purpose, but its client can send the user’s API key to an arbitrary host despite repeated claims that it only contacts api.a7w.cn.

Use this only with a dedicated low-quota API key and keep the host set to the default api.a7w.cn. Do not set --host, A7W_HOST, or the saved config host to a server you do not fully trust, because the client will send your bearer key there. Review paid task behavior before batch use, and rotate the key if you ever ran it with an unintended host.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tainted flow: 'req' from os.environ.get (line 444, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The client allows the request destination to be overridden via --host or the A7W_HOST environment variable, and then automatically attaches the Bearer API key to every outbound request. This creates a credential exfiltration path: if an attacker can influence environment variables, wrapper scripts, or invocation arguments, the user's API key will be sent to an arbitrary host over the network.

Content

Scanner excerpt · scripts/client.py (reported line 128)May include surrounding context.

python

headers["Content-Type"] = "application/json"
    req = urllib.request.Request(url, data=data, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            raw, status = resp.read().decode("utf-8", "replace"), resp.status
    except urllib.error.HTTPError as exc:
        raw, status = exc.read().decode("utf-8", "replace"), exc.code

Tainted flow: 'req' from os.environ.get (line 444, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The streaming chat path has the same issue as the regular request path: it builds a request using a configurable host and includes the Bearer API key before calling urlopen. An attacker-controlled host could receive the credential and also return arbitrary SSE content, making this a network exfiltration risk in an agent context.

Content

Scanner excerpt · scripts/client.py (reported line 451)May include surrounding context.

python

})
    chunks = []
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            for raw in resp:
                line = raw.decode("utf-8", "replace").strip()
                if not line.startswith("data:"):

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

md

| **支持 Skill 规范**（DSH / Claude Code / TRAE 等） | 把整个目录放进宿主的 skills 目录 | AI 自己读 `SKILL.md`，按需执行 `scripts/client.py` |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README forces a specific language for all user-facing instructions and descriptions, which is a natural-language locale policy concern under the stated rules. There is no indication that the skill is region-specific or that users can opt into another language.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 98% confidence

Finding

The skill describes and encourages capabilities equivalent to network access, file read/write, environment credential access, and shell execution, but it does not declare enforceable tool scope such as permissions or allowed-tools in machine-readable metadata. This creates a governance gap where a host may grant broader execution than users expect, increasing the chance of unintended credential use, file access, or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger scenarios are broad and open-ended, causing the skill to activate for loosely related requests without clear exclusions or confirmation boundaries. In a skill that can read files, use credentials, and send data to an external API, overly broad activation materially raises the risk of accidental invocation and unintended data transmission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The endpoint description explicitly states that the pricing response is a '裸对象，没有 code/msg 外壳', which directly contradicts the response schema that models a wrapped object with code, msg, and data. This is an intent/documentation mismatch that could cause callers to parse the response incorrectly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description gives a concrete bare-object example response and warns that there is no code/msg/data wrapper, while the schema defines exactly such a wrapper. This is a direct contradiction between the inline documentation and the declared API behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file title and the entire instructional content are written in Chinese, and line L056 explicitly describes name as a Chinese display name. There is no indication that users may choose another language or that the locale restriction is required for a region-specific purpose, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-apps-tasks.md (reported line 122)May include surrounding context.

对应的 HTTP：

bash

curl -sS -X POST "https://api.a7w.cn/api/v1/apps/voice_tts/tts" \
  -H "Authorization: Bearer $A7W_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"你好世界"}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

该 markdown 文件从标题到全部说明、示例提示词与操作指引均固定为中文，未向用户提供语言/locale 选择，也未说明这是仅面向中文用户或特定地区的文档。根据规则，强制特定语言且无用户 opt-in 属于自然语言层面的语言/locale policy violation。

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

2. 最小请求

bash

curl https://api.a7w.cn/api/v1/chat/completions \
  -H "Authorization: Bearer $A7W_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-openai-compat.md (reported line 17)May include surrounding context.

2. 最小请求

bash

curl https://api.a7w.cn/api/v1/chat/completions \
  -H "Authorization: Bearer $A7W_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 100)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 110)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · openapi.json (reported line 5)May include surrounding context.

json

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · openapi.json (reported line 9)May include surrounding context.

json

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · openapi.json (reported line 459)May include surrounding context.

json

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-apps-tasks.md (reported line 122)May include surrounding context.

md

## 1. 注册与实名

1. 打开 [算力集市](https://api.a7w.cn/)，注册账号。
2. 完成**实名认证**——没有实名无法创建 API Key。
3. 登录 [用户中心](https://api.a7w.cn/user-center.html)。

Static analysis

No suspicious patterns detected.