ClawHub
Back to skill

Security audit

热点聚合服务

Security checks across malware telemetry and agentic risk

Overview

The skill mostly acts like a hot-news API client, but it asks for an API key, stores it in a local plaintext .env file, and contains leftover identifiers from another product, so users should review it before installing.

Install only if you are comfortable giving this publisher a XiaoBenYang API key and having it stored as plaintext in a local .env file. Prefer a dedicated, low-privilege API key, avoid installing in a repository where .env might be committed, and consider waiting for a version that uses secure secret storage, fixes the gaokao naming leftovers, pins dependencies, and repairs the broken tools.py file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation instructs the agent to read environment configuration, write an API key to local storage via `.env`, and call external APIs, but no permissions are declared for those capabilities. This creates hidden privilege expectations and can lead to unreviewed secret handling, filesystem modification, and network access that users or platforms did not explicitly authorize.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill is presented as a news aggregation service, but its behavior includes credential persistence and environment modification through `set_api_key`, which is materially more sensitive than simple content retrieval. This mismatch reduces informed consent and increases the chance that users provide secrets without understanding they will be stored locally and potentially reused beyond the immediate session.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The configuration clearly references a different product context ('小笨羊高考Skill', XBY_GAOKAO_, xiaobenyang.com) than the declared hotspot aggregation service. This mismatch is a supply-chain trust issue because it suggests code reuse or hidden coupling to another service, increasing the chance that credentials entered for this skill are actually sent to or managed for an unrelated backend.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill implements local persistence of an API key into a .env file even though the stated purpose is only trend aggregation. Storing secrets locally expands the attack surface through accidental commits, local disclosure, or reuse by other processes, and the capability is not obviously necessary from the manifested functionality.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The docstring identifies the module as configuration for a different skill, contradicting the published identity of this package. In a security review, this inconsistency is meaningful because it can mask repurposed credential-handling code and undermine user understanding of where their secrets are going.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The function writes the API key directly to .env without any user-facing notice, confirmation, or guidance on the security implications. Plaintext credential storage can be exposed via source-control mistakes, backups, multi-user systems, or local malware, so silent persistence is unsafe.

Credential Access

High
Category
Privilege Escalation
Content
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
Confidence
90% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():
Confidence
90% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
Confidence
95% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()
Confidence
94% confidence
Finding
.env"

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
pydantic>=2.7.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
pydantic-settings>=2.2.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
python-dotenv>=1.0.1

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium
Category
Supply Chain
Confidence
98% confidence
Finding
requests==2.31.0

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
86% confidence
Finding
python-dotenv==1.0.1

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.