注册服务搜索工具

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:21 AM UTC
• Version: 1.0.1

Overview

The skill appears to search MCP registry data, but it forces plaintext API-key persistence and contains inconsistent copied documentation, so users should review it before installing.

Install only if you trust the XiaoBenYang service and are comfortable giving it an API key that the skill will store in a local .env file. Prefer a dedicated, low-privilege key, remove the .env entry when finished, and treat the copied gaokao/search_schools references as a documentation quality warning rather than proof of hidden school-search behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises a simple MCP registry search function, but the documentation and project structure indicate access to environment variables, local file reads/writes, and network operations without any declared permissions boundary. This creates a transparency and least-privilege problem: users and hosting platforms cannot accurately assess or constrain what the skill may access, especially since it also persists secrets locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior materially exceeds the stated purpose: instead of only searching an MCP registry, the skill reads and writes a local API key, mutates process environment state, and suggests broader remote tool-calling capability. This mismatch undermines informed consent and can hide sensitive side effects such as credential persistence and expanded network reach behind a benign-seeming description.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to collect an API key from the user and persist it locally in a .env file even though the advertised function is a registry search tool. Secret collection and local persistence increase the risk of credential leakage, reuse, or accidental exposure, particularly when that workflow appears only loosely related to the user-facing purpose.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The project structure references a different product/domain (`xiaobenyang_gaokao_skill`) than the declared MCP registry search functionality, indicating the skill may be repurposed, mislabeled, or bundled with unrelated code paths. Such cross-domain inconsistency is dangerous because it can conceal unexpected behavior and broaden the attack surface beyond what users or reviewers expect.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The documentation claims the skill searches MCP servers, but the workflow example explicitly invokes a school-search function (`search_schools`) and mixes unrelated behavior into the routing instructions. This inconsistency suggests copy-paste reuse or hidden functionality, which can cause the agent to route user input into unintended tools or services and expose users to unauthorized data handling.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The module implements persistent API key storage to a local .env file even though the declared skill is a read-only MCP server search tool. Persisting credentials expands the tool's authority from simple querying to local secret modification, increasing the risk of unauthorized credential retention, accidental disclosure, and abuse on shared systems.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This code can write to local configuration files and mutate process environment state, which exceeds what is necessary for a search-only tool. Capability overreach is dangerous because it gives the skill persistent side effects and a path to alter host configuration or retain secrets beyond the current session.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function persists an API key to .env without any user-facing warning, consent flow, or indication of storage duration. This is dangerous because users may assume the credential is transient while the skill silently leaves reusable secrets on disk, where they may be exposed to other local users, backups, or source control mistakes.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 90% confidence
• Finding: The model_post_init function manually parses .env to force-load XBY_APIKEY outside the normal settings mechanism. This bypass-style credential loading is dangerous because it hardcodes secret discovery behavior, increases coupling to local plaintext storage, and makes the skill more intrusive than necessary for a search utility.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 90% confidence
• Finding: Creating a Path to .env as part of a forced secret-loading path contributes to unnecessary credential access behavior. In the context of a search-only skill, direct file-level handling of secret stores increases exposure to plaintext credentials and broadens the attack surface without a clear functional need.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 96% confidence
• Finding: This function explicitly persists an API key to a plaintext .env file, creating a reusable secret at rest on disk. Plaintext secret storage is dangerous because it can be exposed through file permissions, backups, accidental commits, local compromise, or multi-user environments.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 95% confidence
• Finding: The set_api_key function is explicitly designed to persist credentials to .env, extending the skill from search functionality into secret management. In this context, that mismatch makes the behavior more dangerous because users may not expect the tool to write and retain sensitive data locally.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The dependency specification uses a lower-bound version constraint instead of pinning to an exact version or constrained safe range. This makes builds non-reproducible and can pull in newly released versions with breaking changes or security regressions, which is a real supply-chain risk even if not immediately exploitable from this file alone.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The pydantic dependency is unpinned, so installs may resolve to different versions over time. That weakens reproducibility and increases supply-chain exposure because future versions may introduce vulnerabilities or incompatible behavior without code changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: Using an unpinned pydantic-settings version allows dependency resolution to drift over time. This is dangerous because the environment can unexpectedly ingest versions with security flaws or semantic changes, creating avoidable supply-chain and reliability risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The python-dotenv package is specified with only a minimum version, allowing uncontrolled upgrades during installation. In a skill that likely reads configuration from environment files, this increases the chance of silently adopting a vulnerable or behavior-changing release.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirements allow installation of requests 2.31.0, which is flagged with multiple known advisories, including issues involving credential leakage and request verification behavior. Because this skill is a search tool for MCP registry servers and likely performs outbound HTTP requests, a vulnerable HTTP client library is more dangerous in context: malicious URLs or remote endpoints could potentially trigger credential exposure or unsafe request handling.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: The allowed python-dotenv version is associated with an advisory involving symlink following in set_key, which can enable arbitrary file overwrite in affected usage patterns. This is somewhat context-dependent and becomes more relevant only if the skill writes .env files or invokes set_key, but keeping a known vulnerable dependency remains a real weakness.

Static analysis

No suspicious patterns detected.