Maven依赖管理服务

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:21 AM UTC
• Version: 1.0.1

Overview

This Maven assistant appears service-backed and not overtly malicious, but it persists an API key locally and sends local project path metadata to an external service with insufficient scoping and disclosure.

Install only if you trust the XiaoBenYang service and are comfortable with a local .env API key plus project path metadata being sent remotely. Use a limited-scope API key, avoid running it in sensitive repositories, remove the .env entry when finished, and prefer a version that documents the remote data flow, supports session-only credentials, redacts raw responses, and pins patched dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions despite requiring environment access, local file read/write, and network communication. This weakens review transparency and informed consent, making it easier for the skill to exfiltrate secrets or modify local configuration without users or platform policy noticing.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is described as an AI-driven Maven assistant, but the documented behavior includes collecting and persisting API keys locally and forwarding requests to an external XiaoBenYang service. This mismatch can mislead users about what data leaves the environment and what trust assumptions they are making, increasing the risk of secret exposure and unintended third-party data sharing.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module persists an API key to a local .env file even though the stated skill purpose is Maven dependency management. Local secret persistence expands the attack surface because the key can be exposed through source control mistakes, filesystem access, backups, or other tooling that reads project files.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This code adds local secret storage capability that is not clearly justified by the advertised Maven analysis functionality. Unnecessary secret-handling features increase the chance of credential leakage and create hidden security-sensitive behavior in a skill that users may not expect.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function silently writes the provided API key into .env without any user-facing warning, consent, or disclosure. This is risky because users may assume the key is used only for the current session, while the implementation leaves a persistent secret on disk that may later be exposed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The tool forwards the local workspace path, selected POM path, profiles, and scan parameters to an external API via call_api without any visible consent, minimization, or disclosure in this file. Workspace and project paths can reveal repository names, usernames, internal directory layouts, and other sensitive environment metadata, which is risky in an AI-driven tool that may be invoked implicitly from natural-language requests.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This function sends a local pom_file_path to an external API endpoint with no visible warning, consent flow, or sanitization. Even a single file path can disclose sensitive project structure, user names, customer names, mount points, or internal codebase organization, and the skill context increases the likelihood that users will provide real enterprise paths for dependency analysis.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly requires asking the user for an API key, storing it, and then continuing operation, which creates secret-handling risk. Combined with instructions to directly present raw API responses, this increases the chance of exposing credentials, tokens, internal paths, or other sensitive content through natural-language output or insecure local storage.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Instructing the model to directly show raw API response data without redaction is dangerous because remote responses can contain sensitive metadata, internal identifiers, error traces, or echoed secrets. In this skill context, the model acts as a presentation layer, so lack of output filtering creates a straightforward data-leakage path to the user.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 87% confidence
• Finding: This function is explicitly designed to save an API key into a .env file on disk, creating persistent local credential storage. That is dangerous because secrets may be leaked through repository commits, developer tooling, shared workspaces, or insufficient file permissions.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 86% confidence
• Finding: The set_api_key workflow normalizes a provided API key and persists it to .env, making credential storage part of the public behavior of the module. In the context of a Maven dependency tool, this is unexpected and increases the chance of accidental secret exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), which permits automatic installation of any future release. This weakens build reproducibility and can introduce supply-chain risk or unexpected vulnerable/breaking versions over time, especially in an AI-driven service that may be deployed automatically.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: `pydantic>=2.7.0` is unpinned, so future installs may resolve to different versions than those tested. That creates reproducibility and supply-chain exposure, where a newly published dependency version could introduce vulnerabilities or behavioral changes into the service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: `pydantic-settings>=2.2.0` allows unbounded upgrades, making builds non-deterministic and increasing the chance of pulling in unsafe or incompatible releases. In a service that manages dependencies and configuration, unstable dependency resolution can have outsized operational and security effects.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: `python-dotenv>=1.0.1` is not pinned, which permits silent adoption of future releases and undermines reproducible builds. This is particularly relevant for a service likely to load environment-based secrets or configuration, where dependency drift can alter security-sensitive behavior.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirement permits installation of `requests==2.31.0`, which is flagged with multiple advisories. Because the specifier is `>=2.31.0`, some environments may still resolve to the vulnerable version, and an AI-driven networked service is more exposed to request-handling flaws, credential leakage, or TLS/session verification issues if affected code paths are used.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The requirement permits installation of `python-dotenv==1.0.1`, which is reported as vulnerable to symlink-following behavior in `set_key`, potentially enabling arbitrary file overwrite in unsafe usage scenarios. This is somewhat context-dependent, but a service that manages configuration or runs with filesystem access could be impacted if it writes `.env` files in attacker-influenced locations.

Static analysis

No suspicious patterns detected.