Fantasy NBA 数据服务

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:20 AM UTC
• Version: 1.0.1

Overview

This Fantasy NBA skill has enough mismatched documentation and under-disclosed API-key persistence that users should review it before installing.

Install only if you are comfortable providing an API key to the XiaoBenYang-backed service and having that key stored in a local .env file. Review and clean up the unrelated gaokao/school-query content, document the third-party endpoint and credential handling, and pin or update dependencies before trusting it in a sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill appears to require environment access, local file read/write, and network access, yet no permissions are declared. That creates a transparency and consent problem: users and host platforms may not realize the skill can persist secrets locally and send data to a remote service. In this context, the hidden capability is more concerning because the skill explicitly handles API keys and instructs storing them in local configuration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to be a Fantasy NBA MCP server, but the documentation indicates it actually acts as a client/proxy to a third-party XiaoBenYang service, reads API credentials from environment files, and persists credentials locally. This mismatch is dangerous because it obscures data flows, secret handling, and third-party dependence, preventing informed trust decisions by users and reviewers.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The document contains workflow and project-structure content that clearly belongs to an unrelated gaokao/school-query skill. Such cross-skill contamination is dangerous because it can cause the agent to invoke wrong tools, mishandle user input, or follow instructions that do not match the actual capability boundaries of this skill.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The inline tool example instructs the model to call a nonexistent and unrelated function, `search_schools`, which conflicts with the listed Fantasy NBA tools. This can misroute execution, cause failures, and in a broader agent environment may trigger unintended tool selection or parameter shaping based on unrelated domains.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code persists an API key into a local .env file and keeps helper functions for setting and retrieving it, which goes beyond a read-only NBA data service and creates unnecessary secret-handling behavior. Storing secrets on disk increases exposure through accidental commits, local disclosure, backup leakage, or reuse by other processes.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This file implements credential management and persistence logic unrelated to the stated function of serving NBA statistics and analysis. Expanding the skill's capability to manage local secrets increases attack surface and can enable collection or retention of sensitive credentials without necessity.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The docstring and environment prefix refer to a different domain ("高考" / gaokao) than the declared Fantasy NBA service, indicating code reuse, repackaging, or mismatch between manifest and implementation. Such inconsistencies are a strong trust signal failure because they can hide unexpected behavior, confuse operators, and suggest the skill may not be what it claims to be.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill writes API keys to .env and process environment state without any explicit user disclosure, consent flow, or warning about persistence. Users may reasonably assume a read-only data skill does not modify local secret files, making this behavior risky and misleading.

Credential Access

High

• Category: Privilege Escalation

Content

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

• Confidence: 88% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 91% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 91% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 96% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 95% confidence
• Finding: .env"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: pydantic>=2.7.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: pydantic-settings>=2.2.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: python-dotenv>=1.0.1

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: requests==2.31.0

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: python-dotenv==1.0.1

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.