Li Python Sec Check

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:27 PM UTC
• Version: 0.0.2

Overview

This is a coherent Python security-checking skill with local scanning by default, but users should be careful with its optional LLM feature and test-only unsafe example code.

Use the default local scanning mode for sensitive or proprietary code. Only enable or call the LLM analyzer with a trusted endpoint and a token intended for that endpoint, because snippets and scan results may be transmitted. Do not run the unsafe example Flask app except in an isolated test environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/llm_analyzer.py:27

Finding

Configurable LLM Endpoint Can Receive Sensitive Scan Data and Bearer Credentials

Content

View full analysis

str: """调用 LLM API""" if not self.api_key: return self._fallback_analysis(prompt) try: import requests headers = { 'Authorization': f'Bearer {self.api_key}', 'Content-Type': 'application/json' } payload = { 'model': self.model, 'messages': [ {'role': 'system', 'content': '你是一个专业的 Python 安全专家和隐私保护顾问。'}, {'role': 'user', 'content': prompt} ], 'temperature': 0.3, 'max_tokens': 2000 } response = ...[truncated 2891 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:10

Finding

Unpinned Dependencies Are Installed Without Integrity Verification

Content

View full analysis

=6.0.0 # 安全扫描 bandit>=1.7.0 # 依赖漏洞扫描 pip-audit>=2.5.0 # 开发依赖 pytest>=7.0.0 pytest-cov>=4.0.0 ``` The documented installation procedure installs this manifest without hashes: ```bash # 克隆项目 git clone https://github.com/your-repo/Li_python_sec_check.git cd Li_python_sec_check # 安装依赖 python -m venv .venv source .venv/bin/activate pip install -r requirements.txt ``` ### Technical Analysis Every dependency is specified with `>=`, permitting any future version satisfying the minimum constraint. The installation process does not use: - Exact reviewed versions. - A generated lock file. - Package hashes. - `pip --require-hashes`. - A documented trusted package index. - Separation between runtime, scanning, and development dependencies. Python package installation may execute package build backends or other installation-time logic. If an upstream package, release account, package index, or dependency is compromised, users can automatically receive the compromised version even if the Skill itself has not changed. The listed package names are established projects, and the audit found no evidence that the current dependencies are malicious. This finding concerns the absence of reproducibility and integrity controls rather than a confirmed malicious package. The documentation also uses the placeholder repository URL `https://github.com/your-repo/Li_python_sec_check.git`, which does not establish a verifiable canonical source for users. ### Attack Path 1. An attacker compromises a listed package, one of its transitive dependencies, an upstream release account, or the package distribution channel. 2. The attacker publishes a release with a version greater than or eq ...[truncated 1069 chars]

Remediation

View remediation

=` constraints with exact versions in a deployment lock file. - Review updates before regenerating the lock file. 2. **Verify package integrity** - Generate hashes for all direct and transitive dependencies. - Install with `python -m pip install --require-hashes -r requirements.lock`. - Retain the human-maintained input requirements separately from the fully resolved lock file. 3. **Separate dependency groups** - Keep core runtime dependencies separate from development and test tools. - Make `flake8`, `bandit`, `pip-audit`, `pytest`, and `pytest-cov` explicitly optional where appropriate. - Avoid installing development tools in production or minimally privileged scanning environments unless needed. 4. **Constrain the package source** - Document the intended package index. - In controlled environments, use an internally mirrored and reviewed package repository. - Prevent fallback to untrusted extra indexes. 5. **Harden installation** - Install inside an isolated virtual environment or container. - Do not run `pip` as root. - Use a minimally privileged CI account without unrelated production credentials. 6. **Establish source provenance** - Replace the placeholder GitHub URL with the canonical repository. - Sign releases or publish verifiable checksums and release provenance. - Document the expected repository owner and release verification process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill presented as a compliance or security analysis tool but actually starting an application server and lacking any visible scanning logic is a serious trust-boundary violation. Even if not directly exploitable on its own, this mismatch strongly indicates deceptive packaging that can hide unauthorized services or unsafe behavior from users and reviewers.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A skill presented as a compliance or security analysis tool but actually starting an application server and lacking any visible scanning logic is a serious trust-boundary violation. Even if not directly exploitable on its own, this mismatch strongly indicates deceptive packaging that can hide unauthorized services or unsafe behavior from users and reviewers.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/目录扫描功能验证.md (reported line 314)May include surrounding context.

bash

# 1. 复制配置示例
cp .env.example .env

# 2. 编辑 .env 文件
TARGET_PROJECT_DIR=/path/to/your/project

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/目录扫描功能验证.md (reported line 316)May include surrounding context.

md

# 1. 复制配置示例
cp .env.example .env

# 2. 编辑 .env 文件
TARGET_PROJECT_DIR=/path/to/your/project
OUTPUT_DIR=./reports
PYTHON_VERSION=3.9

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/目录扫描功能验证.md (reported line 330)May include surrounding context.

md

# 1. 复制配置示例
cp .env.example .env

# 2. 编辑 .env 文件
TARGET_PROJECT_DIR=/path/to/your/project
OUTPUT_DIR=./reports
PYTHON_VERSION=3.9

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file's behavior materially differs from the declared purpose of a local Python security checker and instead exposes a vulnerable web application with dangerous runtime capabilities. This mismatch increases risk because users may trust and run the skill expecting analysis functionality while actually enabling exploitable endpoints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Executing shell commands from HTTP request input is unjustified for a security checking tool and creates a direct remote command execution path. The skill context makes this more dangerous because users would not reasonably expect this capability in a local analyzer and may run it with elevated trust.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This route builds a shell command by concatenating untrusted request input and executes it with os.system, which allows command injection. An attacker can supply shell metacharacters in the host parameter to execute arbitrary OS commands on the server.

Content

Scanner excerpt · examples/unsafe-example/app.py (reported line 30)May include surrounding context.

python

@app.route('/ping')
def ping():
    host = request.args.get('host', 'localhost')
    os.system("ping -c 1 " + host)

# ❌ eval 注入
@app.route('/calc')

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Arbitrary expression evaluation has no legitimate role in a Python security standards checker and directly enables remote code execution. Because it is exposed as a web endpoint, exploitation is trivial and can lead to full compromise of the application environment.

Content

No source excerpt is available for this finding.

eval() call detected

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

Calling eval on attacker-controlled input gives remote users the ability to execute arbitrary Python expressions and potentially achieve code execution. In a Flask app, this is especially dangerous because the input comes directly from an HTTP request and can expose server data or fully compromise the process.

Content

Scanner excerpt · examples/unsafe-example/app.py (reported line 36)May include surrounding context.

python

@app.route('/calc')
def calc():
    expr = request.args.get('expr', '1+1')
    return str(eval(expr))

if __name__ == '__main__':
    # ❌ 调试模式开启

Known Vulnerable Dependency: flask==2.3.0 — 4 advisory(ies): CVE-2026-27205 (Flask session does not add `Vary: Cookie` header when accessed in some ways); CVE-2023-30861 (Flask vulnerable to possible disclosure of permanent session cookie due to missi); CVE-2023-30861 (Flask is a lightweight WSGI web application framework. When all of the following) +1 more

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The file pins Flask to version 2.3.0, which is flagged with multiple known advisories including session/cookie handling issues. Using a dependency version with known CVEs can expose applications built from this environment to information disclosure, cache poisoning-related behavior, or other framework-level attacks depending on how Flask features are used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: pycryptodome==3.18.0 — 2 advisory(ies): CVE-2023-52323 (PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption); CVE-2023-52323 (PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file pins pycryptodome to 3.18.0, which is associated with a known OAEP decryption side-channel leakage vulnerability. If the project performs RSA OAEP decryption with this library, an attacker may be able to infer sensitive information through timing or side-channel analysis, undermining cryptographic protections.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file presents the skill’s instructions, usage, and operational details entirely in Chinese, including headings, descriptions, and workflow guidance. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill metadata declares no tool scope or permissions even though the associated implementation reportedly uses sensitive capabilities including environment access, file read/write, network, and shell execution. Missing scope declarations weaken reviewability and containment, making it easier for a dangerous skill to obtain broad execution powers without informed user consent or policy enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The publish guide includes destructive lifecycle commands such as hiding, deleting, and undeleting a skill, but does not clearly warn about operational impact, recovery limits, or the need for confirmation and authorization checks before use. In a documentation-driven workflow, users may copy and run these commands directly, causing accidental service disruption, loss of visibility, or unintended removal of a published artifact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This documentation advertises privacy-information leakage and data-security scanning capabilities but does not warn users that scanning may require reading source code, configuration, logs, or other potentially sensitive project contents. In a security-analysis skill, that omission can mislead users into providing confidential material without understanding data-handling boundaries, especially when the skill also mentions LLM-based analysis elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document encourages enabling LLM analysis and supplying an API key while scanning project code, but it does not clearly warn that source code, findings, filenames, or metadata may be transmitted to an external service. In a security-scanning tool context, users may scan proprietary or regulated codebases, so the omission increases the risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A Flask web server is not justified by the stated purpose of a local Python security checking tool and unnecessarily expands the attack surface. Exposing request-handling capability makes subsequent insecure behaviors remotely reachable and increases deployment risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file executes a shell command with os.system, which is a safety-relevant operation under the audit criteria. Although the file has a general warning that it is unsafe for testing, there is no specific confirmation prompt, user-facing log/print, or explanatory comment at the operation itself disclosing that a shell command will be run.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language documentation and embedded prompts entirely in Chinese, including explicit response templates and system instructions that constrain the model to answer in Chinese-language formats. The file does not provide any user opt-in, locale selection, or documented region-specific justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module explicitly states that code snippets and scan results may be sent to an external LLM API, which creates a real confidentiality and data-governance risk. In a tool marketed as 'local-first' security checking, this is especially sensitive because users may reasonably expect scanned source code, secrets, or privacy findings to remain local unless they knowingly opt in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The code performs an outbound POST to a configurable external API endpoint and sends prompts that may include code snippets, file paths, line numbers, and full serialized scan results. In a security scanning tool, that can leak proprietary code, secrets, or regulated data to third parties, and the configurable endpoint increases the risk of accidental or malicious exfiltration to an untrusted host.

Content

Scanner excerpt · scripts/llm_analyzer.py (reported line 194)May include surrounding context.

python

'max_tokens': 2000
            }
            
            response = requests.post(
                f'{self.api_base}/chat/completions',
                headers=headers,
                json=payload,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and surrounding user-facing text establish the tool entirely in Chinese and tie it to China-specific guidance, with no indication that users may choose another language or locale. The policy for this audit flags language or locale constraints when they are imposed without explicit user opt-in or documented justification for the current file's context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Dockerfile check warns unless the timezone is set to Asia/Shanghai and unless domestic mirror sources are configured, which embeds a specific regional locale/network policy into the tool's behavior. Because the file does not clearly justify this as a region-specific compliance tool or offer an opt-in, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.