域名查询服务

• Outcome: Review
• Latest audit: Jul 2, 2026 · 5:01 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a real domain lookup wrapper, but it collects and stores an API key in plaintext and contains stale unrelated instructions that make the data flow harder to trust.

Install only if you trust the XiaoBenYang backend and are comfortable giving it a domain-query API key. Prefer setting XBY_APIKEY through your environment or a secret manager instead of chat, avoid committing the generated .env file, and review raw WHOIS/RDAP results before sharing them because they may include contact or registration details.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation indicates capabilities to read environment variables, write files, and perform network access, yet no permissions are declared. This creates a transparency and consent problem: a user or host may not realize the skill can persist secrets locally and call remote services. In this context, the undeclared capabilities are especially concerning because the skill explicitly asks for an API key and stores it.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose claims a domain research MCP server with RDAP/WHOIS/DNS functionality, but the behavior described includes local credential persistence and references to an apparently unrelated '小笨羊/高考' service. This mismatch is dangerous because it can mislead users into trusting the skill for one purpose while it handles secrets and routes data to a different remote backend than expected.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The workflow example instructs the model to call a school-search function unrelated to domain lookup. Such instruction inconsistency can cause incorrect tool routing, accidental disclosure of user inputs to the wrong function or service, and operator confusion during review. In a tool that already handles credentials and remote API calls, this increases the risk of unintended data flows.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The module adds credential persistence logic that writes an API key to a local .env file, which is broader than a read-only domain lookup service needs. In a skill advertised as a domain research tool, unexpected secret storage expands the attack surface and can expose credentials through filesystem access, backups, logs, or later disclosure bugs.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This code can write arbitrary credential material to a local file and mutate process environment state at runtime. Those capabilities are not justified by the stated domain-query purpose and create unnecessary opportunities for credential leakage or unintended side effects in the hosting agent process.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function silently persists the API key to .env without any warning, consent flow, or indication of retention. Users may reasonably expect a temporary in-memory configuration, so silent persistence can lead to unintentional long-term storage of sensitive credentials on disk.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to ask the user for an API key in natural language and persist it via configuration storage. This creates a sensitive-secret collection and retention workflow that may capture credentials in chat history and write them to local storage without clear security controls, rotation policy, or user consent boundaries.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The directive to directly present raw API response data to the user bypasses review and sanitization. RDAP/WHOIS-style data can include registrant, admin, abuse, or contact details, so blindly echoing raw responses may expose personal or sensitive information unnecessarily.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 88% confidence
• Finding: The code forcibly reads .env directly and extracts a specific API key, bypassing the normal settings abstraction. In the context of a domain lookup skill, explicit secret parsing is more sensitive than necessary and increases the chance of mishandling credentials or normalizing insecure local-secret storage.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 88% confidence
• Finding: Directly checking for and reading a local .env file to obtain credentials introduces local secret-access behavior beyond the tool's stated purpose. If the host environment is shared or the repository is mishandled, this pattern can contribute to credential exposure and makes the skill less transparent about its secret handling.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 92% confidence
• Finding: This function is explicitly designed to save an API key into .env, creating persistent local storage of a secret. Storing credentials in plaintext application files is risky because they can be exposed through source-control mistakes, local compromise, backups, or broad file permissions.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 90% confidence
• Finding: The setter is explicitly documented to persist the API key to .env, reinforcing a workflow of storing secrets on disk within application configuration files. For a domain-query skill, that is an unnecessary and potentially unsafe credential-management feature that increases exposure without clear functional need.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or incompatible releases through the supply chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: Using an unpinned version range for pydantic means different environments may install different package versions, increasing the chance of unexpected behavior or exposure to newly introduced vulnerable releases. This is a supply-chain hygiene issue rather than an immediately exploitable flaw by itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: An unpinned pydantic-settings dependency permits non-deterministic dependency resolution, which can pull in future versions with security defects or breaking changes. This increases operational and supply-chain risk, especially for a service component intended to run as an MCP server.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The python-dotenv package is not pinned to a single version, so dependency resolution may vary and later installs could pick a version with known flaws or incompatible behavior. For environment-loading libraries, this can affect configuration security and reliability.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The requirements allow installation of requests 2.31.0, which has published advisories including credential leakage via malicious URLs and TLS verification issues in certain Session flows. Because this skill is a domain research service that performs network lookups, use of a vulnerable HTTP client is more relevant than in a purely offline tool and could expose secrets or weaken transport security when handling attacker-controlled domains or URLs.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: The requirements permit python-dotenv 1.0.1, which is flagged for a symlink-following issue in set_key that may allow arbitrary file overwrite in affected usage patterns. This is only directly exploitable if the skill actually invokes set_key on attacker-influenced paths, which is not shown in this file, so the practical risk from this evidence alone is limited but real at the dependency level.

Static analysis

No suspicious patterns detected.