万物识别

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.0

Overview

This looks like an API-backed image recognition skill, but it needs Review because it stores API keys in plaintext and has mismatched, under-scoped configuration that can affect where credentials and images are sent.

Review before installing. Use only non-sensitive images unless you accept sending them to Xiaobenyang's API, avoid running it in shared workspaces, check for XBY_GAOKAO_BASE_URL overrides, and rotate the API key if the .env file may have been exposed. The publisher should remove the Gaokao copy-paste remnants, validate the API origin, and replace plaintext .env persistence with a safer credential mechanism.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:47

Finding

API Key Persisted in an Unprotected Plaintext Environment File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/call_api.py:49

Finding

Configurable API Destination Can Receive Authentication Credentials and Image Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims to be an image-recognition skill, but the documentation references .env persistence, environment mutation, sensitive credential handling, and even configuration associated with a different 'gaokao' skill package. That inconsistency strongly suggests copy-paste reuse or mispackaging, which can lead to secret leakage, unintended behavior, and reviewers approving a skill under false assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to be an image-recognition skill, but the documentation references .env persistence, environment mutation, sensitive credential handling, and even configuration associated with a different 'gaokao' skill package. That inconsistency strongly suggests copy-paste reuse or mispackaging, which can lead to secret leakage, unintended behavior, and reviewers approving a skill under false assumptions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The post-init hook forcefully reads XBY_APIKEY from .env, implementing custom secret extraction logic outside normal configuration handling. This increases risk by normalizing plaintext secret use and making the skill actively seek credentials from local storage, which is unnecessary and suspicious for the stated object-recognition purpose.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Creating a Path to .env here is part of the custom credential access flow used to retrieve secrets from local plaintext storage. In this skill context, that behavior is unjustified and contributes to credential exposure risks if the file is readable by other users, included in backups, or mishandled in development workflows.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This image-recognition skill includes code to persist, retrieve, and globally manage API credentials, which is unrelated to the declared functionality and expands the attack surface. In the context of a simple recognition skill, local credential management is an unjustified capability that can expose secrets to other local processes, accidental commits, or reuse by unrelated code.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The function explicitly writes the API key into a local .env file, creating plaintext secret persistence on disk. For a vision labeling skill, this is more dangerous because users would not reasonably expect local secret storage, increasing risk of credential leakage through filesystem access, backups, logs, or source-control mistakes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This function is dedicated to saving an API key into .env, directly enabling plaintext local secret persistence. Because the declared skill is only for image label recognition, this credential-storage capability is unnecessary and materially increases the chance of secret disclosure or misuse.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill requests and appears to use sensitive capabilities such as environment access, local file read/write, and network access, but does not declare any explicit tool scope or permission boundaries. This weakens reviewability and least-privilege enforcement, making it easier for a seemingly simple image-recognition skill to exercise broader capabilities than users would expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill asks users to provide image URLs or base64 image data but does not clearly warn that this content will be transmitted to an external API service. This is a privacy and data-handling risk because users may submit sensitive images or internal URLs without informed consent, especially given the skill's benign-sounding image-labeling purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The docstring states the configuration is for a different skill ('高考') than the declared image-recognition skill, indicating code reuse or mismatch between manifest and implementation. That inconsistency undermines trust, makes review harder, and increases the likelihood that hidden or unintended functionality—such as unrelated credential handling—has been carried over.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code persists an API key to .env without any user-facing notice, consent flow, or storage warning. Even if the key is legitimately needed, silently storing credentials in plaintext can surprise users and lead to unsafe operational handling, especially in consumer or shared environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This function sends a user-supplied image URL to an external API for processing, but the file provides no user-facing disclosure, consent flow, or privacy warning. Images and image URLs can contain sensitive personal or internal data, so silent transmission to a third party creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This function transmits raw base64-encoded image content to an external API without any visible warning or consent mechanism in the file. Because the full image bytes are forwarded directly, this may expose sensitive visual content or embedded metadata to a third party without adequate transparency.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill documentation says this skill is for image object recognition, and the listed tools are general_recognition and general_recognition_for_data_base64. However, the mandatory workflow example tells the model to call scripts.tools.search_schools(...), which belongs to a different domain and contradicts the stated toolset and intent of this skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest and the rest of the file describe a 万物识别 image-labeling skill, but the project structure block identifies the package as xiaobenyang_gaokao_skill, which suggests a gaokao/school-related skill. This is an active documentation contradiction rather than a mere omission, and it can mislead agents about the skill's true scope and tooling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only, so builds may resolve to different versions over time, including versions with known security defects or breaking behavior. In a skill that likely makes outbound HTTP requests for image recognition, leaving requests unpinned weakens supply-chain control and makes it harder to verify whether vulnerable versions are excluded.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Requests has multiple known advisories, but because the manifest does not pin a version, it is impossible to verify from this file whether the installed release contains the fixes. In a network-facing image recognition skill, any vulnerable HTTP client version could affect credential handling, TLS behavior, or request safety depending on usage elsewhere in the code.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using pydantic>=2.7.0 without an exact version allows non-deterministic installs and makes it unclear which security fixes are actually present at deployment time. Because pydantic often processes untrusted input, unresolved version drift can expose the skill to parser or validation bugs in later or intermediary releases.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

Pydantic has known advisories and the current requirement does not establish which concrete version is installed, so the deployment may inadvertently include a vulnerable release. This is especially relevant if the skill validates untrusted API input or configuration data, where parsing flaws can become denial-of-service or validation-bypass issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The pydantic-settings package is also unpinned, so environments may install different releases with different security properties. For configuration-loading components, this creates uncertainty around protections for secrets and file-handling behavior.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The advisory status of pydantic-settings cannot be verified because no exact version is pinned. If the skill relies on settings or secret-loading features, a vulnerable version could affect configuration integrity or secret file handling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

python-dotenv>=1.0.1 permits any later release, preventing reproducible builds and making it difficult to prove that vulnerable versions are not deployed. Since dotenv tooling reads and may modify environment/config files, version ambiguity can matter for file-handling and secrets exposure risks.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

python-dotenv has known advisories, and the unpinned requirement means the actual installed version cannot be validated from this manifest. If dotenv file manipulation features are used, vulnerable versions may enable unsafe file writes or symlink-related abuse in certain environments.

Content

No source excerpt is available for this finding.