ClawHub
Back to skill

Security audit

货币与石油价格服务

Security checks for vulnerabilities and agentic risk

Overview

The skill offers currency and oil-price tools, but it asks for an API key, stores it in a local plaintext `.env` file, and uses mismatched XiaoBenYang/gaokao backend code that weakens trust in where the credential goes.

Review this skill carefully before installing. Use it only if you trust the publisher and XiaoBenYang backend, provide a limited-scope API key if possible, avoid running it in shared repositories or untrusted directories, and be prepared to rotate the key if the local `.env` file may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/call_api.py:55
Finding

Configurable Upstream Endpoint Can Expose the API Key

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/config.py:43
Finding

API Key Is Persisted in a Plaintext File Without Secure File Controls

Content
View full analysis
bool: """Save the API key to the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return False def set_api_key(api_key: str) -> bool: """Set the API key and persist it to .env.""" if not api_key or not api_key.strip(): return False api_key = api_key.strip() if not save_api_key_to_env(api_key): return False ``` ### Technical Analysis The Skill stores the API key directly in a plaintext `.env` file in the current working directory. It uses `Path.write_text()` without explicitly creating the file with owner-only permissions or verifying the security of an existing file. The implementation also does not verify that `.env` is a regular file rather than a symbolic link. If the process runs in an attacker-influenced working directory, a pre-created `.env` symlink can redirect the write to another path accessible to the Skill process. Existing file permissions are not corrected, and newly created file permissions depend on the process umask. Because the storage path is relative, the resulting secret may also be placed insid ...[truncated 1476 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill appears mislabeled and internally inconsistent: the project references a different service, lacks the declared finance functionality, and includes undeclared local persistence of API keys. This creates a supply-chain style trust problem where a user may install a benign-looking finance skill that actually belongs to another product and handles secrets in unexpected ways.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill appears mislabeled and internally inconsistent: the project references a different service, lacks the declared finance functionality, and includes undeclared local persistence of API keys. This creates a supply-chain style trust problem where a user may install a benign-looking finance skill that actually belongs to another product and handles secrets in unexpected ways.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file is for a skill declared as a currency/oil price service, but it implements configuration and persistence for a different '高考' service and its API key. This mismatch is a strong supply-chain integrity concern because it suggests code reuse from an unrelated service or hidden functionality, increasing the risk that operators provide credentials to the wrong backend or expose secrets to an unintended system.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python
model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

This code manually opens .env and force-reads XBY_APIKEY outside the standard settings loader, bypassing normal configuration expectations and increasing the chance of silently ingesting credentials from the working directory. In a skill with mismatched service identity, this behavior is more dangerous because it can collect and use secrets for an apparently unrelated backend.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The explicit existence check and subsequent read of .env are part of a custom credential-loading path that silently consumes local secrets. This is risky because it broadens the trust boundary to any .env in the execution directory and can cause unreviewed credential use, especially problematic given the declared-service mismatch in this skill.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python
def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python
if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

This function persists an API key into .env, creating a durable plaintext secret on disk. Plaintext local storage is a real secret-management weakness because credentials may be exposed through repository mistakes, backups, filesystem access by other local users, or later tooling that reads the same .env file.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill requires reading configuration, persisting an API key, and making outbound requests, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, undeclared capabilities reduce transparency and make it harder to enforce least privilege, especially when combined with instructions to write secrets to local configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructions and operational requirements are presented entirely in Chinese and direct the model's behavior in that locale, without any indication that the user can choose another language. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow example calls an unrelated school-search function, which indicates copy-paste contamination from another skill and weakens confidence in the integrity of the package. In security terms, such inconsistencies are a red flag because they can mask unintended or hidden capabilities and increase the chance that the agent invokes the wrong tool path with user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code performs an outbound HTTP POST containing the caller-supplied params and an API key in headers, which is a safety-relevant network transmission. While the file includes internal logging and docstrings, there is no user-facing warning, confirmation, or comment disclosing that user/system data in params will be sent to an upstream service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The docstring labels this as '高考Skill配置' while the published skill claims to provide currency and oil price data. Such contradictions undermine trust boundaries and can mislead reviewers and users into authorizing secrets or network access for a component different from what they believe they are installing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code persistently writes the API key to a local .env file and also places it in the process environment without any user-facing disclosure, consent flow, or storage hardening. This can expose credentials through accidental file inclusion, weak filesystem permissions, backups, logs, or later reuse by unrelated processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

项目结构部分将根目录写为 xiaobenyang_gaokao_skill/，而整个清单与说明都在描述货币汇率和石油价格服务。这表明文档存在从其他技能复制遗留的内容，直接削弱了文档对开发者意图的准确表达。

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency specifier requests>=2.31.0 is unpinned, so builds may resolve to different versions over time. This weakens supply-chain control and makes it harder to ensure vulnerable or incompatible releases are not introduced unexpectedly.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

requests has multiple known advisories, and because the manifest does not pin a version, it is impossible to verify whether deployed environments will avoid affected releases. In a service that likely performs outbound HTTP requests for currency and oil-price data, this uncertainty matters more because network-facing libraries are part of the attack surface.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency specifier pydantic>=2.7.0 is unpinned, allowing future installs to select different releases without review. This creates a supply-chain risk because a newly published vulnerable or malicious version could be pulled into deployments automatically.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

pydantic has known advisories, and the lack of version pinning means the actual installed version cannot be audited from this file alone. If the service validates untrusted API inputs or configuration through Pydantic, vulnerable parser behavior could become reachable depending on the resolved release.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency specifier pydantic-settings>=2.2.0 does not lock the installed version, which makes environments non-reproducible and can silently introduce risky upstream changes. In security-sensitive tooling, predictable dependency resolution is important for auditability and patch management.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
83% confidence
Finding

pydantic-settings has at least one advisory, and the open-ended requirement prevents confirming whether installations will resolve to a safe version. Since settings libraries may read secrets and filesystem-backed configuration, an unsafe version can affect confidentiality or path-handling if those features are used.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency specifier python-dotenv>=1.0.1 is unpinned, so dependency resolution may later select unreviewed releases. This increases the chance of consuming a version with a newly disclosed vulnerability or harmful behavior.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

python-dotenv has known advisories, and without pinning there is no assurance that installed environments avoid affected versions. Because dotenv libraries interact with local configuration files, vulnerable releases can create file-handling or overwrite risks in development or deployment workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The user-facing/docstring text in this file is exclusively in Chinese, including operational messages such as the API key setup error and function descriptions. That can constitute a language/locale policy issue if the skill is expected to be language-neutral and does not offer users a choice of language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The user-visible docstrings, comments, and printed error message are written in Chinese, which indicates the skill is oriented to a single language without any opt-in or alternative. Under the language/locale policy, this is a natural-language constraint that should be explicitly optional or justified.

Content

No source excerpt is available for this finding.