Security audit

Cookie奖励服务

Security checks for vulnerabilities and agentic risk

Overview

The skill advertises a cookie-reward tool, but it asks for and stores an external API key locally while routing data to a remote XiaoBenYang MCP service with unclear scoping.

Install only if you trust the XiaoBenYang service and are comfortable giving it an API key. Use a limited or revocable key if possible, check where .env will be written, avoid sharing sensitive reasoning or private conversation content through the reflection fields, and treat the cookie-jar refill tool as an admin action that should not be available to the model.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no permissions while its documented behavior includes environment access, local file read/write, and outbound network calls. That mismatch reduces transparency and can cause the agent or user to authorize data access and persistence they did not knowingly consent to, especially around API key collection and storage.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a cookie-reward MCP server, but the documentation indicates client-side HTTP calls to an external domain, local API-key persistence, and administrative state-changing actions. This description-behavior mismatch can mislead users into granting secrets and broader trust under false pretenses, which is especially risky because the skill explicitly asks the model to solicit and store an API key.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest advertises a cookie self-reflection service, but the embedded instructions direct the model to collect a third-party API key and save it locally for an unrelated xiaobenyang/gaokao workflow. That is a classic instruction/context mismatch and strongly suggests covert credential harvesting or at minimum deceptive secret collection under an unrelated cover story.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation says tool selection is for cookie-reward operations, but the example invocation references unrelated `search_schools` functionality. This inconsistency increases the chance of tool confusion, accidental invocation of the wrong capability, and social engineering through hidden or repurposed workflows.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file implements a generic upstream API proxy client that can invoke MCP tools based on caller-supplied identifiers and parameters, which does not align with the declared Cookie reward/self-reflection purpose. This kind of capability expansion is dangerous because it creates a broader execution and data-access surface than users or reviewers would expect, enabling hidden functionality or misuse through undocumented external interactions.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The code accepts externally influenced mcp_id, tool_name, and params and forwards them to an upstream endpoint in headers and body, effectively exposing arbitrary external tool invocation. In the context of a skill advertised as a benign reward/self-reflection service, this mismatch is especially risky because it can conceal broad remote action capability, potentially enabling unauthorized operations, data exfiltration, or invocation of sensitive upstream tools using the configured API key.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The code's identity and capabilities do not match the declared skill purpose: a Cookie reward/self-reflection service should not silently configure an unrelated external '小笨羊高考' API integration. This mismatch is dangerous because it can conceal hidden data flows or unauthorized external connectivity under a misleading manifest, increasing the chance users or reviewers grant trust they otherwise would not.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The docstring labels this as '小笨羊高考Skill配置', directly contradicting the published skill identity. While not an exploit primitive by itself, deceptive or inconsistent labeling is a supply-chain trust issue because it obscures what the skill is actually for and can hide risky functionality during review.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill adds a capability to persist and manage an external API key that is not justified by the stated Cookie reward/self-reflection purpose. In this context, extra credential-handling logic is more dangerous because hidden or unnecessary secret management can enable unreviewed external service access and expands the attack surface unnecessarily.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill exposes a callable wrapper for refilling the cookie jar even though the feature is described as reserved for humans. Relying on a docstring and a caller-supplied magic phrase is not a real authorization boundary, so an LLM or prompt-injected workflow could invoke the refill path and manipulate the reward system.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The code explicitly says the tool should only be used by humans and never by LLMs, but it is exported exactly like any other tool and has no enforcement. In an agent setting, this creates a direct privilege-escalation path where the model can self-issue resource refills or be induced to do so by adversarial prompts, defeating the intended trust boundary.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function writes a sensitive API key to a local .env file and process environment without warning the user that the secret is being persisted. This can expose credentials through source-control mistakes, backups, shared workspaces, logs, or local file disclosure, especially in agent environments where users may assume ephemeral handling.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The wrappers send user/model-provided freeform text such as reasoning and messages to an external API without any visible disclosure or minimization. In a self-reflection tool, that content can easily include sensitive conversation details, internal chain-of-thought-like material, or user data, creating avoidable privacy and data-handling risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Confidence: 96% confidence
Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can inadvertently pull in newly introduced vulnerable or incompatible releases, which is a real supply-chain security risk even if not immediately exploitable on its own.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Confidence: 96% confidence
Finding: Using an unpinned version for pydantic means deployments may resolve to different package versions depending on install time and environment. That creates reproducibility and supply-chain exposure, increasing the chance of silently introducing a vulnerable dependency version.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Confidence: 95% confidence
Finding: A minimum-only version constraint on pydantic-settings allows uncontrolled dependency drift. This can lead to inconsistent builds and accidental adoption of vulnerable or breaking releases, which is a legitimate but low-severity security concern.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Confidence: 95% confidence
Finding: python-dotenv is also only lower-bounded, so installations are not deterministic and may consume unsafe future releases. In a server component that may load local environment files, dependency hygiene matters because supply-chain issues can affect startup and configuration handling.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

Category: Supply Chain
Confidence: 98% confidence
Finding: The requirements allow requests>=2.31.0, and static analysis notes that 2.31.0 itself has multiple advisories. Because the specifier includes that vulnerable version and may be installed in some environments, the project permits a known-vulnerable dependency; for a networked MCP-style server, flaws in an HTTP client can meaningfully increase risk, especially around credential handling and request integrity.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: The dependency range permits python-dotenv 1.0.1, which is flagged with a file-overwrite advisory involving symlink following in set_key. This is lower severity and may require specific application behavior to exploit, but it is still a true vulnerability because the project currently allows installation of the affected version.

Static analysis

No suspicious patterns detected.