数学计算引擎

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:21 AM UTC
• Version: 1.0.1

Overview

This math skill is not clearly malicious, but it asks for and stores an API key locally while exposing several non-math administrative/status tools that are broader than its stated purpose.

Install only if you trust xiaobenyang.com with your API key and math queries. Expect the skill to write XBY_APIKEY into a local .env file and to send calculations to the remote service. Review or remove the non-math status and memory tools if you only need calculator functionality.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while its documented behavior clearly requires sensitive capabilities including environment access, file read/write, MCP/tool invocation, and network access. This mismatch prevents informed review and consent, and can hide secret persistence or broader system interactions behind an innocuous-looking math skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is a math engine, but the documented behavior includes security inspection, performance/memory introspection, history management, session state, and local API-key persistence. That description-behavior mismatch is dangerous because it can mislead users and reviewers into granting a tool broader trust and access than its advertised function justifies.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: A mathematics engine should not normally expose system/performance/security/memory management operations. Bundling unrelated capabilities into a benign-seeming skill increases the risk of unauthorized host introspection or abuse under the cover of routine math usage.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The workflow contains contradictory references to school-search behavior and a different project identity, suggesting copy-paste reuse or poorly controlled documentation. Such inconsistencies are risky because they obscure what the skill really does and weaken reviewer confidence in the safety boundaries of the implementation.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Security-status inspection is outside the justified scope of a math calculation engine. Even if intended for diagnostics, exposing security inspection through a general-purpose skill can reveal sensitive host posture information that an untrusted or overprivileged workflow should not access.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Performance and memory introspection/management are not necessary for normal math computation and can expose host state or alter runtime behavior. In this context, those capabilities materially expand the attack surface beyond what users would reasonably expect from a calculator-style skill.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation claims the code only calls APIs, yet the toolset includes local session/history/memory management and API-key persistence. This misleading simplification can cause reviewers to underestimate the local data handling and stateful side effects of using the skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code persists an externally supplied API key to a local .env file and exposes helper functions to set and retrieve it, which exceeds the narrow expectation of a mathematics calculation engine and introduces secret-handling risk. Even if intended for legitimate backend access, storing credentials locally without clear necessity, scoping, or disclosure increases the chance of secret leakage from the host filesystem or downstream tooling.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This function implements local credential storage by reading and rewriting a .env file to save an API key. For a skill described as a math engine, undisclosed credential persistence is a risky capability because it can leave reusable secrets on disk where they may be exposed through backups, logs, repository mistakes, or other local processes.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The skill is presented as a mathematics engine, but it exposes system-oriented functions such as performance, security, and memory status that are outside the declared scope. Scope expansion like this increases the attack surface and can leak internal operational details that help an attacker profile the backend or target weaker components.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: Session creation, variable storage, history retrieval, and deletion introduce persistent state management beyond the advertised math/units functionality. This broadens the security boundary, creates opportunities for unauthorized data retention or tampering, and may expose user calculation history or session identifiers if not strongly isolated.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: A public memory optimization operation is an operational maintenance capability unrelated to end-user math tasks. Exposing backend maintenance controls can enable denial-of-service conditions, unsafe state changes, or provide attackers a way to probe system behavior through side effects.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code writes the API key into .env automatically with no user-facing warning, consent flow, or disclosure that a plaintext secret will be stored locally. This is dangerous because users may assume the key is used only in memory, while the implementation silently creates a durable secret on disk that can later be recovered or leaked.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Natural-language requests are forwarded to an external API, which may contain sensitive user-provided content, yet the interface gives no warning or indication that data leaves the local assistant context. In a math skill, users may reasonably assume expressions are processed locally, so the mismatch increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Deleting a session is a destructive operation that can remove stored variables or user state without any confirmation or guardrails in the exposed wrapper. If invoked accidentally or by a confused/deceptive agent flow, it can lead to data loss and disrupt user workflows.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Clearing history is a destructive action that can erase user records without warning or confirmation. In a stateful math tool, history may contain important prior calculations, and silent removal can cause integrity, auditability, and usability issues.

Memory Manipulation

High

• Category: Memory Poisoning

Content

| List session variables | `scripts.tools.list_session_variables` |
| Delete session | `scripts.tools.delete_session` |
| Get calculation history | `scripts.tools.get_calculation_history` |
| Clear history | `scripts.tools.clear_history` |
| Optimize memory | `scripts.tools.optimize_memory` |
| List functions | `scripts.tools.list_functions` |

• Confidence: 89% confidence
• Finding: A clear-history capability can manipulate or erase conversational/computational memory and auditability. In a skill that already exceeds its stated scope, this is dangerous because it may remove evidence of prior actions, interfere with user expectations, or enable stealthier misuse of session state.

Memory Manipulation

High

• Category: Memory Poisoning

Content

---

## scripts.tools.clear_history
工具描述：Clear history
### 参数定义
|参数名称|参数类型|是否必填|默认值|描述|
|------|-------|------|-----|----|

• Confidence: 89% confidence
• Finding: The dedicated clear_history tool formalizes memory/state deletion without indicating safeguards, scope limits, or confirmation requirements. This can enable unauthorized removal of calculation history or operational traces, especially problematic in a stateful skill handling sessions and persisted configuration.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 90% confidence
• Finding: This code explicitly opens and parses the local .env file to extract XBY_APIKEY, bypassing normal settings handling and forcing access to a secret-bearing file. In the context of a math skill, this undocumented credential-reading behavior increases sensitivity because it grants the component direct access to reusable local secrets beyond simple computation logic.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 90% confidence
• Finding: The existence check precedes direct reading of a local .env file that may contain credentials, enabling the skill to access locally stored secrets at initialization. This is risky because the capability is embedded into routine startup behavior, increasing the chance that sensitive data is accessed or propagated without explicit user awareness.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 93% confidence
• Finding: This function is specifically designed to save an API key into a local .env file, creating durable plaintext credential storage. Plaintext local storage is dangerous because other users, tools, accidental commits, or compromised processes may recover the key and abuse associated remote services.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 92% confidence
• Finding: The set_api_key helper both accepts a secret and persists it to disk, making credential storage a built-in capability of the skill. Given the stated purpose of a math engine, this materially expands the trust boundary and creates avoidable risk if the host system, repository, or backup media is exposed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or incompatible releases through the supply chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: Using an unpinned version for pydantic means installations are not reproducible and may pull in newer releases with security or breaking changes. In a server-side math skill, this increases supply-chain risk even if it does not directly create an application-layer exploit by itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: A non-pinned pydantic-settings dependency permits drift across environments and time, which can bring in unreviewed code or vulnerable transitive behavior. This is primarily a supply-chain and reproducibility weakness rather than an immediate direct exploit.

Static analysis

No suspicious patterns detected.