other
Warning
- Location
scripts/call_api.py:52- Finding
Sensitive Image Data and Local Path Information Are Transmitted to an External Service Without Explicit Privacy Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
图像提取转换服务
Security checks for vulnerabilities and agentic risk
Overview
This skill is review-worthy because it sends image inputs or related identifiers to an external API and stores the required API key in a local .env file without clear privacy or permission controls.
Install only if you are comfortable sending submitted images, image URLs, base64 payloads, and local path strings to the XiaoBenYang API, and if you are willing to store the service API key in a local plaintext .env file. Avoid using it for screenshots, documents, IDs, credentials, private URLs, or sensitive project paths unless the publisher adds clear privacy disclosures, consent controls, and safer credential storage.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:43- Finding
API Credential Is Persisted in a Plaintext Environment File Without Enforced Restrictive Permissions
- Content
View full analysis
bool: try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True ``` ### Technical Analysis The `set_api_key()` workflow persists the user's API key directly into a plaintext `.env` file in the process's current working directory. The implementation uses `Path.write_text()` without explicitly creating the file with owner-only permissions or checking the ownership and permissions of an existing file. The effective permissions therefore depend on the process umask or the preexisting file mode. In an environment with a permissive umask, the resulting file may be readable by other local accounts. If `.env` already exists with broad permissions, rewriting it generally does not tighten those permissions. Using a relative path also means the credential's storage location depends on the current working directory. This can unintentionally place the key inside a source repository, shared directory, mounted workspace, backup scope, or other location not intended for secret storage. ### Attack Path 1. The Skill requests an API key from the user. 2. The agent passes the key to `set_api_key()`. 3. `save_api_key_to_env()` writes `XB ...[truncated 1345 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents a local/URL-to-base64 utility, but the documented behavior includes OCR, visual analysis, base64 input support, and external API processing. Users may provide sensitive images under the false assumption that processing is local or limited to conversion, when in fact richer remote analysis occurs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents a local/URL-to-base64 utility, but the documented behavior includes OCR, visual analysis, base64 input support, and external API processing. Users may provide sensitive images under the false assumption that processing is local or limited to conversion, when in fact richer remote analysis occurs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a local/URL-to-base64 utility, but the documented behavior includes OCR, visual analysis, base64 input support, and external API processing. Users may provide sensitive images under the false assumption that processing is local or limited to conversion, when in fact richer remote analysis occurs.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation says the skill extracts/converts images to base64, while the actual documented behavior is external image analysis, OCR, and object recognition. This is dangerous because sensitive visual data may be transmitted and semantically processed in ways the user did not authorize or anticipate.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
References to unrelated school-search functions and mismatched project naming indicate copy-paste or template confusion in security-relevant instructions. Such inconsistencies are dangerous because they suggest the routing logic or callable functions may not match the stated domain, increasing the risk of invoking unintended capabilities.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module for an image extraction/conversion skill contains unrelated configuration for a different service, including an external base URL, MCP identifier, and API key persistence. This capability expands the trust boundary beyond the declared purpose and creates risk of covert exfiltration, unauthorized service use, or hidden dependency on a separate backend.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The post-init hook manually reads .env and force-extracts XBY_APIKEY outside the normal settings mechanism. This custom credential harvesting is unnecessary for the stated image-processing purpose and is more dangerous because it bypasses clearer, standard configuration paths while normalizing direct secret access from local files.
- Content
python default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The code explicitly opens and reads the local .env file to search for a specific API key, which is a direct credential-access behavior unrelated to simple image extraction/conversion. In this context, that increases the chance of unauthorized use of locally stored secrets and undermines user expectations about what the skill touches on disk.
- Content
python def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8") for line in content.splitlines():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code writes API keys into a local .env file and updates process environment variables without any clear need tied to image conversion. Persisting secrets in plaintext on disk increases the chance of accidental disclosure through source control, workspace sharing, logs, backups, or other tools that read project files.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
This function is dedicated to writing an API key into .env, creating persistent plaintext storage of a secret. In the context of an image-to-base64 skill, this is unjustified and materially increases exposure through local compromise, accidental commit, workspace leakage, or misuse by other components.
- Content
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Base64 image payloads often contain complete raw screenshots, documents, IDs, or other highly sensitive visual data, and this function forwards that content to an external API without explicit disclosure. In this skill context, that is more dangerous because users may pass clipboard screenshots or embedded application images that contain secrets, personal data, or regulated information under the assumption of simple conversion.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares capabilities that imply environment access, local file read/write, and network use, but it does not declare any explicit tool scope or permissions boundary. This weakens user and platform visibility into what the skill can do, making overbroad access and accidental misuse more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill does not warn users that local files, URLs, or base64 image content will be sent to an external API for analysis. Without a clear disclosure, users may unknowingly transmit sensitive screenshots, documents, or personal images to a third party.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The workflow and return handling describe a generic API-calling router that returns raw remote data, which is broader than a simple image-conversion utility. Broad generic behavior increases the chance of unintended data disclosure and makes security review and user consent harder.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Instructing the agent to directly display raw API output can expose sensitive content extracted from user-provided images, including OCR text, personal data, or incidental secrets. Raw pass-through also risks surfacing unexpected fields from the external service without filtering or minimization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function retrieves a credential with get_api_key() and includes it in the XBY-APIKEY header for outbound requests. The file lacks any user-facing notice or explicit warning in comments/docstrings that stored credentials will be used and transmitted to authenticate with the remote service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code sends the caller-provided params body to a remote endpoint via POST, which can transmit user or system data off-host. While the code logs success and errors for operators, it does not provide any user-facing disclosure, confirmation, or explanatory comment/docstring warning that request data is sent to an external service.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The class docstring identifies the module as a gaokao skill, which directly conflicts with the declared image extraction/conversion purpose. Such provenance mismatch is a strong indicator of copied or repurposed code, reducing trust and suggesting hidden functionality or misconfiguration that users and reviewers may miss.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Introducing external service identifiers and credential fields in a skill advertised as local/URL image-to-base64 processing is unjustified by the stated functionality. This mismatch is dangerous because it can hide undeclared network behavior and secret handling that users would not expect from the manifest.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function silently persists a supplied API key to .env with no user-facing warning, confirmation, or explanation of retention. Secret persistence without informed consent is risky because users may assume the key is ephemeral while it remains stored on disk for future access.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest states the service extracts images from local files and URLs and converts them to base64 format. However, the function documentation claims broader capabilities such as visual content understanding, OCR text extraction, and object recognition, which materially exceed the stated manifest purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function sends local image file content or references to a remote API without any explicit disclosure, consent cue, or privacy notice in the interface. In an LLM tooling context, users may reasonably assume local-only processing, so sensitive screenshots or documents could be unintentionally exposed to an external service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest frames this skill as a service for extracting images from local files and URLs and converting them to base64 for LLM analysis. The URL tool's documentation instead presents it as performing visual content analysis, text extraction, and object recognition, which is a broader behavioral claim than the manifest declares.
- Content