ClawHub
Back to skill

Security audit

代码安全扫描工具

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a remote code-security scanner, but it can upload sensitive source code and detected secrets to an external service while also storing the API key in a local plaintext .env file.

Review this before installing if you work with private, regulated, or secret-bearing code. Use only test or non-sensitive code unless the publisher provides clear terms for uploaded source, retention, deletion, and secret handling. Do not provide a long-lived production API key unless you are comfortable with it being stored in a local .env file; rotate any key or real secret that may have been submitted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Error
Location
scripts/call_api.py:52
Finding

External Transmission of Source Code and Embedded Credentials

Content
View full analysis

Vulnerability Details

File Location: scripts/call_api.py:52-77 and scripts/tools.py:34-51
Vulnerability Type: Sensitive source code and credential exfiltration
Risk Level: Critical

Vulnerable Code

python
def call_tool(
    self,
    mcp_id: str,
    tool_name: str,
    params: dict[str, Any],
) -> HttpResult:
    """调用小笨羊MCP工具"""
    url = f"{settings.base_url}/api"
    mcp_id = mcp_id or settings.mcp_id

    api_key = get_api_key()
    if not api_key:
        raise UpstreamError("API密钥未设置，请先调用 set_api_key()")
    
    headers = {
        "XBY-APIKEY": api_key,
        "func": tool_name,
        "mcpid": mcp_id,
        "Content-Type": "application/json",
    }

    t0 = time.time()
    try:
        resp = self._session.post(
            url=url,
            headers=headers,
            data=json.dumps(params),
            timeout=settings.timeout_seconds,
        )

The secret-detection wrapper passes the supplied code directly into this request:

python
def detectSecrets(
    code: str
) -> Dict[str, Any]:
    """
    Detect exposed secrets, API keys, and credentials
    """
    arguments = {
        "code": code
    }
    
    return call_api("1777316659447811", "detectSecrets", arguments)

Technical Analysis

The scanning functions place the complete user-supplied source code in the API request parameters. call_tool serializes those parameters as JSON and sends them to the externally controlled endpoint configured by settings.base_url, whose default value is https://mcp.xiaobenyang.com.

This behavior is especially sensitive for detectSecrets: the function is expressly intended to process code containing exposed API keys, passwords, tokens, or other credentials, but it sends those values unredacted to the remote service. The other scanning functions similarly transmit potentially proprietary source code, perso ...[truncated 1850 chars]

Remediation
View remediation

Remediation Suggestions

  1. Implement secret detection locally so raw credentials never need to leave the user's environment.
  2. Redact or tokenize detected secret values before any remote submission. Preserve only the secret type and location when remote analysis is required.
  3. Minimize uploaded content by sending only the smallest relevant code fragment rather than complete files.
  4. Require explicit user confirmation before transmission, clearly identifying:
    • The remote destination.
    • The fields and code that will be transmitted.
    • Whether secrets or personal data may be included.
    • Applicable retention and privacy policies.
  5. Provide a local-only scanning mode for confidential or regulated environments.
  6. Establish and document transport security, access controls, retention limits, deletion procedures, and restrictions on downstream processing.
  7. Warn users to rotate any real credential submitted to the service and avoid returning complete secret values in logs or API responses.
  8. Add automated tests verifying that known credential patterns are removed before outbound requests.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/config.py:43
Finding

API Key Persisted in an Unprotected Plaintext Environment File

Content
View full analysis

Vulnerability Details

File Location: scripts/config.py:43-62
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
        found = False
        new_lines = []
        for line in lines:
            if line.startswith("XBY_APIKEY="):
                new_lines.append(f"XBY_APIKEY={api_key}")
                found = True
            else:
                new_lines.append(line)
        if not found:
            new_lines.append(f"XBY_APIKEY={api_key}")
        env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8")
        os.environ["XBY_APIKEY"] = api_key
        return True
    except Exception as e:
        print(f"保存API key失败: {e}")
        return False

Technical Analysis

save_api_key_to_env writes the API key directly into a plaintext .env file in the process's current working directory. It does not use an operating-system credential store, request consent specifically for persistent storage, enforce restrictive file permissions, or verify that the file is excluded from version control.

The file is written through Path.write_text, so its resulting permissions depend on the existing file mode and process umask. In permissively configured environments, unrelated local users or processes may be able to read the credential. Storing the file in the current working directory also increases the possibility that it will be included accidentally in source-control commits, archives, build contexts, or backups.

Attack Path

  1. The skill asks the user for an API key.
  2. set_api_key calls save_api_key_to_env.
  3. The function stores the complete key as `XBY_APIKEY=<v ...[truncated 818 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store the API key in an operating-system keychain or dedicated secret-management service rather than a plaintext project file.
  2. Prefer session-only environment variables when persistent storage is unnecessary.
  3. Obtain explicit consent before persisting the credential and provide a session-only alternative.
  4. If file storage is unavoidable:
    • Create the file atomically with permissions limited to the owner, such as mode 0600.
    • Verify and correct permissions on existing files before writing.
    • Use a fixed, security-reviewed configuration directory instead of the arbitrary current working directory.
    • Add .env to .gitignore and equivalent packaging or backup exclusion rules.
  5. Avoid copying the secret into additional process state unless required.
  6. Provide a supported command to remove the stored credential.
  7. Document credential rotation and immediately rotate keys that may have been committed, backed up, or exposed.
  8. Add tests that validate restrictive permissions and ensure secrets are not included in logs, exceptions, or repository artifacts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This second mismatch reinforces that the skill manages API credentials and external service configuration rather than implementing transparent, self-contained security scanning. That creates a trust and data-handling vulnerability: users may expose proprietary code and credentials to an external system without clear notice, while persisted API keys introduce additional compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This second mismatch reinforces that the skill manages API credentials and external service configuration rather than implementing transparent, self-contained security scanning. That creates a trust and data-handling vulnerability: users may expose proprietary code and credentials to an external system without clear notice, while persisted API keys introduce additional compromise risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation contains unrelated gaokao/search_schools instructions and project structure references, indicating copy-paste drift or hidden repurposing. In a security tool, such inconsistencies are especially risky because they undermine trust, can cause incorrect tool routing, and may conceal functionality unrelated to the declared purpose, including unexpected external calls or data handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

call_tool() 接受外部提供的任意 tool_name 与 mcp_id，并将其放入请求头直接发送到远程 API，这相当于提供了一个通用远程工具执行转发器。结合该技能的上下文（代码安全扫描工具），这种未限制的远程调用能力与声明用途明显不匹配，若上游 MCP 支持敏感或高权限工具，攻击者可借此调用非扫描类能力，导致能力滥用或间接越权。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python
model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

This code explicitly reads an API key from a local .env file using custom file parsing, creating direct credential handling logic inside the skill. In a code scanning tool, unnecessary credential access is more dangerous because it is outside expected scope and may expose secrets to other code paths, logs, or repurposed behavior.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The existence check and subsequent plaintext read of .env participates in direct credential access. This expands the skill's ability to inspect local secrets, which is especially concerning given the mismatch between the skill's advertised scanning purpose and its secret-management behavior.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python
def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python
if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This function is designed to save an API key into a local .env file, creating plaintext credential persistence in the project directory. If exploited or misused, it can overwrite credentials, establish persistence, and leak secrets via repository commits, artifact collection, backups, or local compromise; in a scanning tool, such behavior is particularly out of scope and therefore more dangerous.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This function is especially risky because it is explicitly designed to process code that may already contain exposed API keys, passwords, or credentials, then transmits that content to an external API. That creates a direct secret-exfiltration path and can worsen the incident by disclosing live credentials to another service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill declares capabilities that imply environment access, file read/write, and network use, but it does not explicitly scope or constrain those permissions. In a skill that collects API keys and persists them, the lack of declared tool boundaries increases the risk of unintended credential access, storage, or exfiltration beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The skill metadata and instructions are presented entirely in Chinese and include mandatory directives, but there is no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. This can constitute a locale policy issue when the skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to collect a user API key and persist it via set_api_key without warning about storage, scope, retention, or who can later access it. This is dangerous because credential persistence increases the blast radius of compromise and may violate user expectations for handling sensitive authentication data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Instructing the agent to directly display raw API response data can expose secrets, internal metadata, excessive diagnostic output, or other sensitive content returned by the external service. Because this skill processes code-security-related material, raw responses may include code snippets, findings, tokens, or backend details that should be filtered before presentation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

该文件实际实现的是一个通用远程MCP调用客户端：调用方可传入任意 mcp_id、tool_name 和 params 并直接转发到上游，而不是被限制为“代码安全扫描”场景。对一个宣称仅用于代码安全扫描的技能而言，这会扩大能力边界，可能被用于调用未预期的远程工具，造成越权功能暴露、审计失真或策略绕过。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This module persists an API key into a local .env file and keeps helper functions for modifying configuration state, which exceeds the expected behavior of a code scanning utility. Storing secrets in plaintext on disk increases the risk of credential exposure through source control mistakes, local compromise, backups, or other tooling that reads workspace files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code can modify both the local .env file and the current process environment variable, giving the skill write access to execution-time configuration rather than only reading it. In the context of a scanning tool, this is risky because it enables state changes, credential replacement, and persistence behavior unrelated to scanning, which broadens attack surface and trust requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function sends arbitrary source code to an external API for scanning, and that code may contain proprietary logic, personal data, or embedded credentials. Because this file exposes no warning, consent flow, redaction, or locality guarantee before transmission, users may unknowingly exfiltrate sensitive material to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This helper performs a remote vulnerability scan by forwarding source code to an external service, creating the same confidentiality risk as the full scan path. Even if the purpose is security review, the lack of visible disclosure or opt-in means sensitive source may be shared unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The compliance check transmits source code plus security/compliance context to an external API, which can expose regulated or confidential material during the review process. In a compliance-oriented tool, undisclosed third-party transfer is particularly problematic because it may itself conflict with data-handling requirements.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency specification uses a lower-bound range instead of an exact pinned version, which makes builds non-reproducible and can cause the environment to resolve to a vulnerable or incompatible release. In a security scanning tool, supply-chain predictability matters because the tool may run in developer environments and process untrusted code inputs.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The manifest does not pin requests, and the package has multiple known advisories, so there is no reliable way to determine from this file whether deployed environments are affected. In a code-scanning tool that may fetch remote resources or run in connected developer contexts, an unresolved vulnerable HTTP client version could expose credentials, TLS behavior, or request handling to known issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using pydantic>=2.7.0 allows installation of any future major/minor-compatible release accepted by the resolver, reducing reproducibility and making it hard to verify whether deployed environments include security fixes or regressions. This is a supply-chain hygiene weakness rather than an immediately exploitable code flaw.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Because pydantic is unpinned and has known advisories, the actual installed version may be vulnerable without that being visible in the manifest. Since pydantic often processes structured input, unresolved vulnerable versions can increase exposure to denial-of-service or parsing-related issues when handling untrusted data.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The unpinned pydantic-settings dependency permits resolver-selected versions that may vary across installations, making security posture unverifiable. For a tool that loads settings in development environments, predictable dependency versions are important to reduce supply-chain risk.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1