手势检测

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

This gesture-detection skill appears to use a remote API as intended, but it stores API keys in a local plaintext .env file and allows endpoint configuration that could redirect sensitive image data and credentials.

Review before installing. Use only if you are comfortable sending image URLs or full base64 image data to Xiaobenyang and storing the API key in a local plaintext .env file. Prefer a dedicated low-privilege API key, avoid sensitive images, check the .env file contents and permissions, and do not run this in a workspace where untrusted files or environment variables can alter the API base URL.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:10

Finding

Configurable API Endpoint Can Expose API Keys and Image Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:44

Finding

API Key Is Persisted in a Plaintext Workspace File Without Explicit Permission Hardening

Content

View full analysis

bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The API key is written in plaintext to `.env` in the process's current working directory. The code does not explicitly create or enforce restrictive file permissions, so effective access depends on the host's umask and any pre-existing file permissions. Storing the secret in a workspace also increases the likelihood that it will be copied into backups, archived with the project, exposed to other processes or local users, or accidentally committed to version control. The implementation also performs no check that `.env` is a regular file rather than a symbolic link. ### Attack Path 1. A user provides an API key as directed by the Skill. 2. `set_api_key()` calls `save_api_key_to_env()`. 3. The function writes the complete credential as `XBY_APIKEY=...` into the workspace `.env` file. 4. A local user or process with workspace read access retrieves the key, or the file is inadvertently included in a repository commit, archive, backup, or diagnostic bundle. 5. ...[truncated 735 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to perform image analysis but also reads from .env, persists API keys, manages base URLs and retry settings, and includes credential-management helpers unrelated to gesture detection. This broad hidden functionality increases the attack surface and can expose users to credential mishandling or unauthorized reconfiguration of remote destinations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to perform image analysis but also reads from .env, persists API keys, manages base URLs and retry settings, and includes credential-management helpers unrelated to gesture detection. This broad hidden functionality increases the attack surface and can expose users to credential mishandling or unauthorized reconfiguration of remote destinations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The model_post_init function force-reads a local .env file to extract XBY_APIKEY outside normal typed settings flow, creating custom secret-harvesting logic not justified by the declared skill. In context, this is more dangerous because the skill ostensibly performs local image gesture detection, so collecting and persisting unrelated credentials is unexpected and broadens attack surface.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Creating a Path to .env and reading it as part of custom initialization contributes to unauthorized or unnecessary credential access behavior in this skill's context. Even if intended for convenience, this behavior can expose secrets from local developer environments and is inconsistent with a narrowly scoped image-detection tool.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This hand-gesture detection skill includes logic to persist and manage an external API key in local files and process environment, which is unrelated to the declared image-analysis purpose. Such credential-handling expands the trust boundary, creates secret exposure risk on disk, and is especially suspicious because the file also references a different product/domain than the manifest.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code writes user-supplied credentials to a local .env file and modifies process environment variables, capabilities that are unjustified for a simple gesture-detection skill. This can leave secrets recoverable from the filesystem, source bundles, backups, or logs, and increases the chance of unauthorized reuse by other code on the host.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The function explicitly saves an API key to .env, creating persistent plaintext local credential storage. In a skill whose stated purpose is gesture detection, this is unnecessarily dangerous because secrets may be exposed through repository inclusion, backups, local compromise, or reuse by unrelated processes.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though it is documented as using environment access, file reads/writes, and network access. That creates unnecessary privilege and reduces reviewability, making it easier for a seemingly simple image-analysis skill to access credentials, persist secrets, or exfiltrate data through undeclared capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to collect an API key from the user and persist it via set_api_key without warning that the credential will be stored. This is dangerous because users may disclose sensitive secrets without informed consent, and persistence to local configuration or .env increases the risk of later leakage through file access, backups, or other tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The project structure and examples reference a gaokao/school-search skill instead of the declared gesture-detection functionality, indicating copy-paste drift or repurposed code. Such inconsistency is a security concern because it suggests the skill may invoke unrelated logic or hide capabilities that reviewers and users would not expect from the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code sends the caller-provided params to an external HTTP endpoint and includes an API credential in the request headers. While the behavior is implemented clearly, there is no confirmation prompt, print/log disclosure to the user, or inline warning comment/docstring indicating that user data may be transmitted off-system.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The class docstring describes a different skill domain ('高考' configuration) than the manifest's hand-gesture detection purpose, indicating code reuse, mismatch, or possible repackaging. Context mismatches make security review harder and increase suspicion that hidden or unintended behavior may be present, especially alongside unrelated credential-management code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The function persists an API key to .env without any visible warning, confirmation, or notice about durability and scope of storage. Users may reasonably expect a transient configuration value, but the code silently creates long-lived local secret exposure that can be read later by other tools or users on the system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The function sends a user-supplied image URL to an external API service, but this file provides no disclosure, consent flow, or indication of data handling boundaries. Even if the feature requires remote inference, transmitting image content or image references off-platform can expose sensitive visual data and metadata to a third party without the user's awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This function transmits raw base64-encoded image content to an external API, which is a direct transfer of potentially sensitive user data. Because the file contains no warning, consent mechanism, or privacy guardrails, users may unknowingly send biometric or otherwise private visual information to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The entire skill description, prompts, and operating instructions are presented only in Chinese, and there is no statement that users may interact in other languages or that the locale limitation is intentional for a region-specific use case. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow section claims the model should choose tools for this gesture-detection skill, yet the concrete example demonstrates a school-search call with score/province/category parameters. This is an active contradiction in the documentation because it instructs behavior unrelated to hand-gesture detection.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower-bound only (requests>=2.31.0), which allows future unresolved versions to be installed and prevents reproducible builds. This increases supply-chain risk because a vulnerable or breaking release could be pulled in without review, and the separate advisory listing for requests makes the uncertainty more relevant.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

requests has multiple known advisories, but the manifest does not pin an exact version, so it is impossible to verify whether deployed environments are using a safe release. In a skill that may make outbound HTTP requests, uncertainty around a network-facing library increases supply-chain and runtime risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

pydantic>=2.7.0 is unpinned, so installations may resolve to different future versions with unknown security properties. This is a supply-chain hygiene weakness rather than an immediate exploit, but it can expose deployments to newly introduced vulnerable releases.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

pydantic has known advisories, and because only a minimum version is declared, the actual installed version cannot be assessed for exposure. This is dangerous because input-validation libraries are often security-relevant, and a vulnerable version could affect parsing or cause denial of service.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using pydantic-settings>=2.2.0 without an upper bound or exact pin means the runtime package version is not controlled. That weakens reproducibility and can silently introduce vulnerable or incompatible versions into the skill environment.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

pydantic-settings has at least one known advisory, but the lack of an exact version means exposure cannot be determined from this file alone. Since settings libraries can read secrets and filesystem paths, unverifiable versions create avoidable uncertainty around secret-handling behavior.

Content

No source excerpt is available for this finding.