生物年龄计算服务

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:19 AM UTC
• Version: 1.0.1

Overview

This skill appears to support a biological-age API workflow, but it stores an API key in a local plaintext .env file and has unclear scope signals that users should review first.

Install only if you are comfortable giving this skill a third-party API key and having it stored in a local .env file. Treat biological-age inputs as potentially sensitive health-related data, confirm what external service receives them, and consider using a limited or revocable API key until the publisher documents storage, retention, and allowed remote calls more clearly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes capabilities to read environment state, persist credentials to local files, and call external network services, but no explicit permissions or user-facing disclosure are declared. This increases the chance that users or the host agent will authorize broader behavior than expected, especially because the skill also requests and stores an API key.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is a narrow biological-age calculator, but the behavior described by the analysis indicates a more general remote API wrapper with credential handling and access to unrelated external infrastructure. This mismatch is dangerous because it can mislead users and reviewers about the real trust boundary, enabling unexpected data exfiltration, broader tool invocation, or misuse of stored credentials.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The workflow example references an unrelated school-search function, which is inconsistent with a biological age service. Such cross-domain leftovers are a red flag for copied or repurposed skills and may indicate that routing logic or backend calls can invoke unintended functions beyond the advertised medical-style calculation.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file implements storage, retrieval, and persistence of a third-party API key to a local .env file, which is not clearly justified by a biological-age calculation skill. This expands the skill's capability to manage secrets on disk and in process environment, increasing the risk of credential exposure or unintended reuse beyond the declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code can persist credentials locally by modifying .env, creating a durable secret store on the user's machine without clear necessity tied to the stated service purpose. Persistent local storage increases the chance that other local processes, backups, version-control mistakes, or users can access the credential.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to ask the user for an API key and persist it via local configuration without warning about storage, retention, or exposure risks. Credential collection and file persistence are sensitive operations; without transparency and secure handling, secrets can be stored insecurely, reused unexpectedly, or leaked through logs and local files.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Directing the model to display raw API response data to the user without filtering or validation can expose sensitive, malformed, or unexpected content from the external service. Because this skill uses a remote API and stores credentials, unreviewed raw responses could disclose tokens, internal identifiers, error traces, or other data outside the intended result.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function writes an API credential to .env with no user-facing disclosure, consent flow, or warning about persistence. Users may expect a temporary configuration change, while the code actually leaves a recoverable secret on disk, which can later be exposed through local compromise, backups, or accidental commits.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 90% confidence
• Finding: The code explicitly and manually reads .env to extract XBY_APIKEY, bypassing normal configuration abstraction and reinforcing dependence on local plaintext secret storage. This increases exposure because any code with workspace access can recover the credential, and manual parsing often leads to weaker handling and auditing than centralized secret management.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 90% confidence
• Finding: Checking for and then reading the local .env file is part of a workflow that accesses plaintext credentials from disk. In the context of a skill whose declared purpose is biological age calculation, this secret-handling behavior is broader than expected and raises the risk of credential disclosure from the project directory.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 95% confidence
• Finding: This function is explicitly designed to save an API key into a .env file, creating plaintext credential persistence on local storage. Plaintext secrets in workspace files are commonly exposed through accidental commits, permissive file permissions, local malware, logs, or backups.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 93% confidence
• Finding: The set_api_key function persists the provided secret to .env as part of normal operation, making credential storage a first-class capability of the skill. In context, that is more dangerous because the skill's declared biological-age purpose does not make local secret persistence obviously necessary, so users may not anticipate the added risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to any newer major or minor version. This weakens build reproducibility and can introduce breaking changes or newly introduced supply-chain risk without review. In this skill, the package also overlaps with a separately flagged vulnerable version range for requests, increasing the importance of controlled versioning.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 88% confidence
• Finding: Using pydantic with only a minimum version makes deployments non-reproducible and exposes the skill to unreviewed upstream changes. While this is not direct exploit code, it is a supply-chain hygiene weakness that can lead to security regressions or runtime breakage.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 88% confidence
• Finding: An unpinned pydantic-settings dependency permits uncontrolled version drift across environments. That creates avoidable supply-chain and stability risk, especially for configuration-handling libraries that may affect how secrets or environment variables are loaded.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 90% confidence
• Finding: python-dotenv is specified with only a minimum version, so installations may vary and pick up unreviewed changes. Because this library interacts with environment/configuration files, weak dependency control can have outsized operational and security consequences.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The dependency specification allows installation of requests 2.31.0, a version with multiple published advisories including credential leakage via malicious URLs and session verification issues. Since this skill is a service and likely performs HTTP interactions, a vulnerable HTTP client can expose secrets, weaken TLS/request safety, or enable other network-driven attacks depending on usage.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: The allowed dependency range includes python-dotenv 1.0.1, which is reported as vulnerable to symlink-following behavior in set_key that may enable arbitrary file overwrite in affected usage patterns. This is less dangerous if the skill never calls the vulnerable API on attacker-controlled paths, but retaining a known vulnerable version is still a valid security issue.

Static analysis

No suspicious patterns detected.