T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:52- Finding
API Key Persisted in a Plaintext File Without Enforced Access Restrictions
- Content
View full analysis
- Remediation
View remediation
Security audit
电动自行车检测
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be an API-backed e-bike image detector, but it has stale unrelated Gaokao configuration and saves an API key in plaintext, so users should review it before installing.
Install only if you are comfortable using the Xiaobenyang remote API, uploading image content or image URLs to that service, and storing XBY_APIKEY in a plaintext .env file. Prefer a scoped/revocable key, avoid sensitive images, and ask the publisher to remove the Gaokao remnants, document data handling, and lock dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Dependencies Are Not Locked to Reviewed Versions
- Content
View full analysis
=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1 ``` ### Technical Analysis Every dependency uses a minimum-version constraint without an upper bound, exact version, lock file, or package hash. A new installation may therefore resolve to future releases that were not reviewed or tested with this project. This does not demonstrate that any currently named package is malicious. The risk arises because the installed dependency graph can change over time and because package artifacts are not cryptographically pinned by the project. A compromised future release or dependency account could consequently enter the build without a source-code change in this repository. ### Attack Path 1. A future release of one of the permitted packages, or one of its transitive dependencies, becomes compromised. 2. A user or automated environment installs the project dependencies after that release is available. 3. The package resolver selects the compromised version because it satisfies the minimum-version constraint. 4. Malicious package behavior executes during installation or when the package is imported. 5. The malicious dependency operates with the privileges of the process installing or running the Skill. ### Impact Assessment The maximum impact depends on the privileges of the installation or runtime process. A malicious dependency could read accessible files and environment variables, including `XBY_APIKEY`; alter application behavior; make outbound network requests; or execute code as the current user. The issue does not itself prove current compromise, and exploitation requires a malicious or compromised package release to be selected during installation. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform electric-bicycle detection, yet the described code path reads/writes API keys, accesses environment variables, and includes unrelated remote-service configuration fields such as base_url and mcp_id. That indicates the skill is effectively a generic remote-service wrapper, which can mislead users into providing secrets and data under false expectations about functionality and scope.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to perform electric-bicycle detection, yet the described code path reads/writes API keys, accesses environment variables, and includes unrelated remote-service configuration fields such as base_url and mcp_id. That indicates the skill is effectively a generic remote-service wrapper, which can mislead users into providing secrets and data under false expectations about functionality and scope.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file’s configuration and identifiers clearly target an unrelated gaokao/XBY API integration rather than the declared electric-bicycle image detection skill. This mismatch is a strong supply-chain integrity issue: users may install a skill expecting local/object-detection behavior while it is actually wired to an external service with different data flows and trust boundaries.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Docstrings and comments describe a gaokao skill, contradicting the manifest’s electric bicycle detection intent. This inconsistency undermines provenance and reviewability, and in the context of a skill package it increases the risk that hidden or unintended capabilities are being shipped under a misleading description.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
This code explicitly opens and parses the .env file to extract a specific API key outside the normal settings abstraction. That custom secret-reading path bypasses safer centralized handling, makes secret access less transparent, and is more dangerous in this skill because the external credential is unrelated to the declared purpose.
- Content
python default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The existence check gates direct reading of a local .env file that may contain sensitive credentials, reinforcing a custom secret-access path. In isolation it is minor, but as part of the surrounding logic it contributes to unsafe and unjustified credential handling within a misleading skill package.
- Content
python def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8") for line in content.splitlines():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This function is expressly designed to save an API key into a .env file, creating durable local storage of sensitive credentials. Persisting secrets in a project-local plaintext file significantly increases risk of credential theft through source-control mistakes, local compromise, backups, or unintended redistribution of the skill package.
- Content
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries despite requiring environment access, file read/write, and network connectivity. In an agent setting, this expands the blast radius: the model is instructed to collect a secret from the user, persist it to disk, and invoke remote services without any declared least-privilege constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill’s natural-language instructions, headings, and user-facing guidance are entirely in Chinese, and there is no indication that users may interact in another language or opt into this locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is documented and justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
L037 的示例调用是
search_schools(...)，而该技能声明的唯一用途是电动自行车检测；这不是简单的文档不全，而是把完全不同领域的工具调用示例放进了当前技能说明中。结合 L091 的项目目录名xiaobenyang_gaokao_skill/，文档明显残留了另一个“高考/学校查询”技能的内容，主动误导了实现意图。- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill includes functionality to persist and manage an external API credential even though that need is not justified by the stated image-detection purpose. Unnecessary secret handling expands the attack surface, can lead to credential leakage via local files or process environment, and is especially concerning given the broader manifest/code mismatch.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code writes the API key into a local .env file and mirrors it into the process environment without any user-facing consent, warning, or storage-hardening. This can expose credentials through filesystem access, accidental check-in, backups, logs, or other code running in the same process environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The function sends a user-supplied image URL to an external API endpoint via call_api, but this file provides no disclosure, consent handling, or indication that image content may leave the local environment. Because images can contain personal or sensitive information, undisclosed third-party transmission creates a real privacy and data-governance risk even if the functionality is expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This function transmits raw base64-encoded image data to an external API, which is a direct transfer of potentially sensitive image content. The lack of explicit warning or consent in the code path increases privacy risk, since users may not realize full image contents are being exfiltrated to a remote processor.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
L091 将项目根目录写为
xiaobenyang_gaokao_skill/，但整份清单和工具说明都在描述电动自行车检测。这种文档内容会让读者误解代码所属能力和边界，属于文档意图与当前技能实际定位相冲突。- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency uses a lower-bound version specifier instead of an exact pin, which makes builds non-reproducible and can silently pull in different releases over time. This increases supply-chain risk and makes it impossible to verify whether a known-vulnerable or breaking version of requests will be installed in a given environment.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
The manifest does not pin requests, and the package has multiple published advisories, so there is no way to determine from this file whether the deployed version is affected. This uncertainty is a real supply-chain weakness because vulnerable versions could be installed depending on resolution time and environment.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Using pydantic>=2.7.0 allows any newer version to be installed, which weakens reproducibility and complicates assurance that only vetted versions are used. In practice this can expose deployments to newly introduced vulnerabilities or incompatible releases without code changes.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
Because pydantic is not pinned and has known advisories, the requirements file cannot guarantee that an unaffected version will be installed. This leaves security status unverifiable and can result in accidental deployment of a vulnerable release.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The unpinned pydantic-settings dependency permits uncontrolled upgrades at install time. That creates a supply-chain hygiene issue because the actual installed version may vary across systems and may include vulnerable or behavior-changing releases.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The unpinned pydantic-settings dependency has at least one advisory associated with it, but this manifest does not establish whether the installed version is affected. That ambiguity is risky in environments that may process local configuration or secrets, because vulnerable versions could be introduced without visibility.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
python-dotenv is specified with a minimum version only, so installations are not deterministic and may resolve to unexpected future releases. This can increase exposure to known or newly introduced package flaws and makes incident triage harder.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
python-dotenv has known advisories, and the lack of an exact version pin means the actual installed release cannot be verified from the manifest. This is a supply-chain control gap that could allow a vulnerable version to be installed, especially in automated or fresh deployments.
- Content