细胞系知识资源服务

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:18 AM UTC
• Version: 1.0.1

Overview

The skill appears to advertise Cellosaurus access while using unrelated Xiaobenyang/Gaokao tooling, remote forwarding, and local API-key persistence that users would not reasonably expect.

Review this carefully before installing. Only proceed if you intentionally trust the Xiaobenyang backend, understand that queries and credentials may be handled by that service, and are comfortable with an API key being stored in a local .env file. Prefer a version whose names, examples, credential variables, allowed tools, and remote endpoints all clearly match the Cellosaurus purpose.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities to read environment configuration, write an API key via `set_api_key()`, and call external network services, but it declares no permissions or trust boundaries. This is dangerous because users and orchestrators cannot accurately assess that the skill will persist secrets locally and transmit data to a remote service, increasing the risk of unintended secret exposure or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill claims to access the SIB Cellosaurus resource, but the workflow requires obtaining an API key from `xiaobenyang.com`, storing it locally, and using a backend identity and package naming associated with an unrelated XiaoBenYang/gaokao service. This mismatch is dangerous because it can trick users into disclosing credentials and biological query data to an unexpected third-party service under false pretenses.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The workflow example instructs the model to call `search_schools(...)`, which is unrelated to Cellosaurus and suggests copied or mismatched operational logic from another domain. In security terms, this inconsistency undermines trust in the skill’s true behavior and raises the risk that user inputs may be routed to unintended tools or services.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The project structure identifies the package as `xiaobenyang_gaokao_skill`, which conflicts with the claimed Cellosaurus identity and suggests code reuse from an unrelated service. While not direct code execution, this discrepancy increases the likelihood of hidden or unintended integrations and makes provenance and data handling less trustworthy.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The code is a generic forwarding client to an external '小笨羊MCP API' selected by configurable base URL, MCP ID, tool name, and arbitrary params, rather than a constrained client dedicated to Cellosaurus. In the context of a skill advertised as a Cellosaurus knowledge service, this mismatch is dangerous because it can silently route user data and tool invocations to an unrelated third-party backend, expanding trust boundaries and enabling unauthorized data exfiltration or unexpected remote actions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata claims this is a Cellosaurus knowledge-resource service, but this module manages and persists an API key for a different service namespace (XBY/Xiaobenyang Gaokao). That mismatch is a strong indicator of hidden or repurposed functionality, and the code also stores the credential locally and in process environment state, creating a plausible path for unauthorized credential collection or misuse.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The class docstring and configuration namespace identify the code as belonging to a different skill than the declared Cellosaurus service. In a security review, this kind of identity mismatch is dangerous because it suggests the package may be mislabeled to conceal unrelated behavior, including credential handling for another backend.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code writes the supplied API key directly into a local .env file without any visible warning, consent flow, or controls around file permissions. Persisting secrets this way can expose credentials to other local users, accidental source-control commits, backups, logs, or later exfiltration by unrelated code.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 93% confidence
• Finding: This code forcefully reads .env and extracts XBY_APIKEY for a service unrelated to the declared Cellosaurus functionality. In context, that is dangerous because it appears designed to access a credential the user would not expect this skill to need, increasing the risk of covert secret collection or misuse.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 93% confidence
• Finding: The explicit opening and parsing of .env to locate XBY_APIKEY is suspicious in this skill because the secret belongs to a different service domain than the advertised one. This context turns ordinary file access into a likely unauthorized credential-access path.

Credential Access

High

• Category: Privilege Escalation

Content

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

• Confidence: 90% confidence
• Finding: The getenv call overrides the parsed value with XBY_APIKEY from the process environment, again for an unrelated service. In the context of a mislabeled skill, this broadens credential acquisition to multiple sources and increases the chance of silently capturing or using secrets not intended for this tool.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 91% confidence
• Finding: This function is explicitly designed to persist an API key into .env, which is insecure unless carefully controlled. Even if not overtly malicious, storing secrets in plaintext local config can lead to accidental disclosure through repository commits, shared workspaces, backups, or later compromise of the host.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 89% confidence
• Finding: This entry point advertises that setting the API key will persist it to .env, meaning callers may trigger durable secret storage as a side effect. That creates unnecessary credential-retention risk, especially in a skill whose declared purpose does not justify handling this unrelated secret.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower-bound constraint only, so future installs may resolve to different versions over time. This weakens build reproducibility and can unexpectedly introduce vulnerable or breaking releases into the skill's environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: Using an unpinned pydantic version allows dependency resolution to float to any newer release satisfying the minimum version. That can cause nondeterministic builds and accidental adoption of insecure or incompatible versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: An unpinned pydantic-settings dependency means installations are not reproducible and may pull in future versions with security regressions or unexpected behavior changes. In security-sensitive tooling, this increases supply-chain risk even if no exploit is present in the file itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: The python-dotenv package is also only minimum-bounded, so environments may install different versions depending on timing and index state. This increases supply-chain uncertainty and can silently introduce vulnerable releases.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: The finding indicates requests 2.31.0 has published advisories, and the current constraint explicitly permits installation of that vulnerable version. In an MCP server that likely performs outbound HTTP requests, flaws in requests can matter in practice because malicious URLs, redirect handling, credential handling, or session behavior may be reachable through normal server functionality.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: The requirement allows installation of python-dotenv 1.0.1, which the scanner associates with an advisory involving unsafe file overwrite behavior in set_key. This is only exploitable if the skill actually invokes that functionality on attacker-influenced paths, so the risk is contextual, but permitting a known-vulnerable version is still a real dependency hygiene issue.

Static analysis

No suspicious patterns detected.