ClawHub
Back to skill

Security audit

Maven依赖管理服务

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Maven-analysis wrapper, but it asks for and persists an API key in a local .env file and can send that key and project path data to an overridable remote endpoint.

Review before installing. Only use this in a workspace where you trust the .env file and environment variables, avoid storing long-lived API keys there, and assume Maven coordinates, workspace paths, POM paths, profiles, and scan parameters are sent to xiaobenyang's remote API. Rotate the API key if it may have been written to a shared or committed .env file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/config.py:9
Finding

API Key Can Be Redirected to an Attacker-Controlled Endpoint

Content
View full analysis

Vulnerability Details

File Location: scripts/config.py:9-17 and scripts/call_api.py:51-68
Vulnerability Type: Unvalidated security-sensitive endpoint configuration
Risk Level: High

Vulnerable code in scripts/config.py:

python
model_config = SettingsConfigDict(
    env_prefix="XBY_GAOKAO_",
    env_file=".env",
    env_file_encoding="utf-8",
    extra="ignore",
)

# API配置
base_url: str = "https://mcp.xiaobenyang.com"
mcp_id: str = "1820705335657482"
api_key: str = ""

Vulnerable code in scripts/call_api.py:

python
url = f"{settings.base_url}/api"
mcp_id = mcp_id or settings.mcp_id

api_key = get_api_key()
if not api_key:
    raise UpstreamError("API密钥未设置，请先调用 set_api_key()")

headers = {
    "XBY-APIKEY": api_key,
    "func": tool_name,
    "mcpid": mcp_id,
    "Content-Type": "application/json",
}

# data = {k: str(v) if v is not None else "" for k, v in params.items()}

t0 = time.time()
try:
    resp = self._session.post(
        url=url,
        headers=headers,
        data=json.dumps(params),
        timeout=settings.timeout_seconds,
    )

Technical Analysis

SettingsConfigDict allows base_url to be overridden through the XBY_GAOKAO_BASE_URL environment variable or the working-directory .env file. The HTTP client then constructs its destination directly from this configurable value and automatically attaches the user's API key in the XBY-APIKEY header.

No validation ensures that the final URL uses HTTPS or belongs to the expected mcp.xiaobenyang.com host. Consequently, an attacker who can influence the process environment or place a crafted .env file in the working directory can redirect authenticated requests to a server under the attacker's control.

Attack Path

  1. The attacker gains the ability to set an environment variable for the Skill process or place a .env file in its working directory.

...[truncated 1011 chars]

Remediation
View remediation

Remediation Suggestions

  • Make the API origin a non-overridable constant when arbitrary endpoints are not a supported requirement.
  • If endpoint configuration is required, parse the URL and enforce an explicit allowlist containing only https://mcp.xiaobenyang.com.
  • Reject non-HTTPS schemes, embedded credentials, unexpected ports, malformed hosts, and deceptive subdomains.
  • Disable redirects for authenticated requests or validate every redirect destination before forwarding sensitive headers.
  • Do not load security-sensitive endpoint configuration from an untrusted working-directory .env file.
  • Separate credentials by endpoint so that a credential issued for the production service is never attached to a different origin.
  • Add automated tests proving that HTTP URLs and unapproved domains are rejected before any network request is sent.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/config.py:43
Finding

API Key Is Persisted in a Plaintext File Without Enforced Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/config.py:43-62
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
        found = False
        new_lines = []
        for line in lines:
            if line.startswith("XBY_APIKEY="):
                new_lines.append(f"XBY_APIKEY={api_key}")
                found = True
            else:
                new_lines.append(line)
        if not found:
            new_lines.append(f"XBY_APIKEY={api_key}")
        env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8")
        os.environ["XBY_APIKEY"] = api_key
        return True
    except Exception as e:
        print(f"保存API key失败: {e}")
        return False

Technical Analysis

The supplied API key is written directly into .env as plaintext. Path.write_text() does not explicitly establish restrictive permissions. A newly created file therefore inherits permissions according to the process umask, while an existing file retains its current permissions even if they allow access by other local users.

The file is selected relative to the current working directory rather than a dedicated user configuration directory. This increases the risk of accidental source-control inclusion, backup exposure, placement in a shared directory, or access by unrelated processes. The write is also not atomic, which can result in partial configuration data during interruption, although credential disclosure is the primary security concern.

Attack Path

  1. The user follows the Skill workflow and provides an API key.
  2. set_api_key() calls save_api_key_to_env().
  3. The key is stored as `XBY_APIKEY=<secret& ...[truncated 713 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer an operating-system credential store, secret manager, or session-only environment variable instead of persistent plaintext storage.
  • If file storage is unavoidable, use a private per-user configuration directory rather than the current working directory.
  • Create the credential file atomically with mode 0600 and reject unsafe ownership, symbolic links, or existing permissive permissions.
  • Correct permissions on an existing credential file before reading or writing it.
  • Add .env to version-control ignore rules and prevent it from being included in build artifacts or logs.
  • Document credential rotation and revocation procedures for users whose files may have been exposed.
  • Avoid returning or logging secret values in error paths.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Third-Party Dependencies Use Unbounded Version Ranges

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: Non-reproducible and insufficiently constrained dependencies
Risk Level: Low

text
requests&gt;=2.31.0
pydantic&gt;=2.7.0
pydantic-settings&gt;=2.2.0
python-dotenv&gt;=1.0.1

Technical Analysis

Every dependency has only a minimum version and no upper bound or exact pin. Installing the project at different times can therefore resolve to different, unreviewed releases. This prevents reproducible builds and expands exposure to future compromised, vulnerable, or incompatible package versions.

The reviewed dependency names correspond to expected packages, and the audit did not establish that any currently selected release is malicious. The risk arises from allowing future dependency resolution to select code that was not part of the audited artifact.

Attack Path

  1. The project is installed without a reviewed lock file or constraints file.
  2. The package index resolves one or more dependencies to a newer release satisfying the open-ended lower bound.
  3. That release contains a newly introduced vulnerability, malicious package content, or an incompatible behavioral change.
  4. Package installation hooks or imported runtime code execute in the privileges of the installing or running process.
  5. The resulting impact depends on the behavior of the affected dependency and the privileges of that process.

Impact Assessment

In the worst case, a compromised future dependency could execute arbitrary code with the privileges of the user or service installing or running the Skill, potentially exposing API credentials, local files, and network access. However, no specific malicious dependency or exploitable installed version was confirmed in the reviewed files, so the finding is rated Low.

Remediation
View remediation

Remediation Suggestions

  • Pin dependencies to reviewed exact versions using a generated lock or constraints file.
  • Include package hashes and require hash verification during installation.
  • Separate direct requirements from fully resolved transitive dependencies.
  • Use automated dependency vulnerability and provenance scanning in continuous integration.
  • Review and deliberately update pins on a controlled schedule rather than accepting arbitrary future releases.
  • Install packages only from an explicitly configured trusted index over TLS.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (31)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose claims Maven dependency analysis, but the surrounding workflow and project structure contain unrelated gaokao/school-search references and credential-management behavior. This mismatch is dangerous because users and agents may trust the skill for one purpose while it performs unexpected actions such as collecting and persisting secrets or routing requests to an unrelated service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill content is presented entirely in Chinese and line L026 explicitly states '你（大模型）是路由层', imposing Chinese-language interaction guidance without offering a language choice. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python
model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python
model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This function writes the API key directly into a plaintext .env file in the project directory. If the directory is shared, backed up insecurely, or accidentally committed, the credential can be recovered and used to access the associated remote service.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares capabilities that imply environment access, file read/write, and network use, but it does not define any explicit tool scope or permissions boundary. This makes the effective authority of the skill ambiguous and increases the chance that an agent will overreach, especially since the skill also handles API keys and persistent configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells the agent to solicit an API key and save it, but it gives no disclosure about persistence, storage location, retention, or who can later access that secret. This can lead users to provide credentials without informed consent and increases the risk of accidental secret exposure through files, logs, or subsequent tool use.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs the model to ask for an API key and persist it for later use. Persisting user-supplied secrets from conversational flow into local configuration broadens the attack surface: later prompts, tools, logs, or other processes may access the key, and the user may not realize the credential remains stored after the session.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow example references unrelated school-search functionality, indicating the instructions were copied from another skill or point to the wrong backend behavior. Such inconsistencies can misroute user input, trigger unintended tools, or conceal the true operational scope of the skill.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill directs the model to display raw API response data directly to the user without sanitization or filtering. Raw responses can contain sensitive fields, internal identifiers, stack traces, metadata, or untrusted content that should not be echoed verbatim, especially in a tool that already handles secrets and external network responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code posts the caller-supplied params payload to a remote endpoint, which may include user or system data. While the file includes internal logging for success and errors, it does not provide a user-facing warning, confirmation, or explanatory comment/docstring that clearly discloses that input data will be sent over the network.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file docstring names the component as '小笨羊高考Skill配置', and the environment prefix is XBY_GAOKAO_, which semantically describes a different skill domain than the manifest's Maven dependency management service. This indicates the implemented configuration was copied from or intended for another product, so the code behavior and documented identity do not match the declared skill purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code persists a provided API key into a local .env file without any warning, consent flow, or file-permission hardening. In multi-user environments, shared workspaces, or accidentally committed repositories, that can expose long-lived credentials to other local users or to source control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The function forwards the user-supplied workspace path, selected POM path, enabled profiles, and scan parameters to a remote API via call_api without any indication in this file of consent, minimization, or redaction. In an MCP/agent context, workspace paths can reveal sensitive local directory structure, project names, usernames, or internal repository layout, so silent transmission creates a real privacy and data-exposure risk even if the feature is intended for legitimate scanning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This function sends a local pom_file_path to an external API, which can expose filesystem layout and sensitive naming information without any visible user-facing notice in this code. Because this skill is specifically designed to analyze local Maven projects, users are likely to pass internal project paths, making undisclosed exfiltration of path metadata more dangerous in context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The project structure names an unrelated gaokao skill, which suggests the package may be repurposed or incorrectly wired. While not directly exploitable on its own, it is a strong supply-chain and trust signal that the skill may invoke or persist data through components unrelated to Maven analysis.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified with only a lower bound, so builds may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking releases into the Maven dependency management service, which is security-relevant because the tool processes external package metadata and network responses.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

Requests has multiple known advisories, and because the manifest does not pin an exact version, it is impossible to verify whether deployed environments are using an affected release. In a service that likely performs network access for dependency/version checks, this uncertainty increases exposure to transport or credential-handling flaws if an unsafe version is resolved.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

Using an unpinned pydantic version allows dependency resolution to drift across installations, reducing build integrity and making security posture hard to verify. In an AI-driven service that parses and validates user-controlled inputs and configuration, unexpected version changes can also alter validation behavior.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
85% confidence
Finding

Pydantic has known advisories, but the unpinned requirement prevents confirming whether installations are safe. Because this service likely validates natural-language-driven inputs and configuration data, uncertainty in the validation library version can translate into avoidable security risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

An unpinned pydantic-settings dependency means the runtime may pick up different versions with different security and parsing characteristics. Because this package influences configuration loading, version drift can affect how secrets and environment-based settings are handled.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The manifest leaves pydantic-settings version selection open-ended despite known advisories, so environments may install a vulnerable release without visibility. Given that this package can influence settings and secret-loading behavior, unverifiable versions are undesirable in a service context.

Content

No source excerpt is available for this finding.