人头人体检测

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 10:01 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward API-backed image detection tool, with no evidence of deception or unrelated behavior.

Install only if you are comfortable providing a XiaoBenYang API key and sending image URLs or full base64 image contents to that external service. Treat the .env-stored API key as a local plaintext secret and avoid using this on highly sensitive photos unless the provider's privacy terms meet your needs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation indicates capabilities to access environment variables, read/write local files, and make network requests, yet it declares no permissions. This creates a transparency and policy-enforcement gap: users and the host platform may not realize the skill can persist secrets locally and transmit data externally. In this context, the danger is elevated because the skill explicitly requests an API key and sends image data to an outside service.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill metadata describes local person/head detection, but this file adds persistence and management of an external API key, which is unnecessary for the stated functionality and expands the trust boundary. This mismatch suggests hidden remote-service capability or leftover code that could cause sensitive credentials to be stored locally without a clear user need.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code reads, writes, and exposes an API credential through helper functions even though the declared skill purpose does not justify credential management. Unnecessary credential handling increases the risk of accidental leakage, misuse by other components in the same process, and user deception about what the skill actually does.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill processes user-supplied images via external API calls but does not warn users that image data will leave the local environment. This undermines informed consent and can expose sensitive biometric or personal information, especially if users submit photos containing people.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the system to collect the user's API key and persist it via local configuration, but it does not warn the user that their secret will be stored. Persisting secrets without explicit disclosure increases the risk of unauthorized reuse, accidental exposure, or retention beyond the user's expectations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The function silently writes the API key into a local .env file and mirrors it into process environment state without any user-facing warning, consent flow, or storage security controls. Persisting secrets this way can expose them to other local users, accidental commits, backups, logs, or unrelated tooling that reads .env files.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function sends a user-supplied image URL to an external API service, but this file provides no user-facing disclosure, consent mechanism, or indication that image content may leave the local environment. Because images may contain faces or other sensitive biometric information, silent transmission to a third party creates a real privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This function transmits raw base64-encoded image content directly to an external API without any warning or consent signal in the file. Sending the full image bytes is especially sensitive because it may include biometric data, people, surroundings, or other private content, making undisclosed third-party exfiltration more severe than passing a URL alone.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 90% confidence
• Finding: The code explicitly forces reading an API key from a local .env file via custom parsing logic, bypassing normal settings behavior and broadening credential access beyond what the skill's declared function requires. In this context, the manual credential loading is suspicious because the skill claims to do local image detection, not remote authenticated operations.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 90% confidence
• Finding: Creating a Path to '.env' is part of custom credential access logic that reads secrets from local storage outside the stated scope of the skill. In a supposedly local detection skill, this increases the likelihood of hidden or unnecessary secret use and weakens user trust.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 94% confidence
• Finding: This function is dedicated to saving an API key into a local .env file, creating persistent local credential storage that is not justified by the manifest's image-detection purpose. Persisted plaintext secrets are vulnerable to accidental exposure through source control, filesystem access, packaging, or support bundles.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 94% confidence
• Finding: The helper explicitly promises to set and persist an API key to .env, formalizing unnecessary credential retention in a skill that should not need it based on its stated role. This makes misuse easier and normalizes insecure secret storage for users who may not realize the implications.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to any newer version, including breaking or maliciously compromised releases. This weakens build reproducibility and supply-chain control, especially for a skill that likely performs networked API calls using requests.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 91% confidence
• Finding: Using pydantic with only a minimum version permits unreviewed newer versions to be installed, reducing reproducibility and increasing supply-chain exposure. While not immediately exploitable by itself, it is a genuine dependency-management weakness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 90% confidence
• Finding: An unpinned pydantic-settings dependency means deployments may pull different versions over time, including versions with undiscovered or newly introduced security issues. This is a standard supply-chain hardening concern rather than an immediate code execution flaw.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 92% confidence
• Finding: python-dotenv is also unpinned, so environments may resolve to inconsistent or unsafe versions. In a skill that may rely on environment-based configuration, unsafe dependency drift can affect secrets handling and operational safety.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The requirements allow requests>=2.31.0, and static analysis notes that requests 2.31.0 itself has multiple advisories. Because the lower-bound specifier permits installation of the known vulnerable version, environments may resolve to a release affected by issues such as credential leakage or request verification flaws, which is more concerning in a skill likely to fetch remote resources or call external services.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The dependency specifier allows installation of python-dotenv 1.0.1, which static analysis identifies as affected by a file-overwrite issue involving symlink following in set_key. This is a real weakness, though its practical danger depends on whether the skill ever modifies .env files or processes attacker-influenced paths; nothing here suggests malicious intent, but the package choice still leaves exposure.

Static analysis

No suspicious patterns detected.