T09 · Insecure Skill Coding Practices
Error
- Location
scripts/call_api.py:53- Finding
Configurable API Endpoint Can Expose Credentials and Speech Content
- Content
View full analysis
- Remediation
View remediation
Security audit
语音合成服务
Security checks for vulnerabilities and agentic risk
Overview
The skill appears intended to call a remote speech-generation API, but it has mismatched service identity, plaintext API-key persistence, and an overridable authenticated endpoint that deserve review before installation.
Install only if you trust the XiaoBenYang backend and are comfortable storing the API key in a local .env file. Review or constrain the API endpoint before use, avoid committing .env, and rotate the key if it may have been exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:42- Finding
API Key Is Persisted in Plaintext Without Explicit Access Restrictions
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The API key is written directly to a plaintext `.env` file. `Path.write_text` does not explicitly establish owner-only permissions; newly created file permissions depend on the platform and process umask. Existing `.env` files are rewritten without checking or correcting their access mode. The implementation also stores the key in the process environment after writing it to disk. The persistent plaintext copy may be exposed through workspace sharing, backups, accidental source-control commits, permissive filesystem permissions, or another process or user with access to the project directory. The update is not atomic. Rewriting the complete file in place can also corrupt configuration if the process terminates during the operation, although the primary security concern is credential disclosure. ### Attack Path 1. A user supplies a valid API key as directed by the Skill. 2. `set_api_key` calls `save_api_key_to_env`. 3. The key is stored as `XBY_APIKEY=- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/tools.py:3- Finding
Invalid and Unresolvable Tool Type Annotations Can Break Tool Registration
- Content
View full analysis
Dict[str, Any]: ``` ### Technical Analysis The function annotation uses `null`, which is not a Python type, and the return annotation references `Dict` and `Any` without importing them. Because the module enables postponed annotation evaluation through `from __future__ import annotations`, these names may not immediately prevent module import. However, frameworks commonly evaluate annotations to generate tool schemas, validate inputs, or register callable interfaces. When annotations are resolved, `null`, `Dict`, and `Any` are unavailable in the module namespace. This can raise an exception and prevent the advertised speech tool from being registered or invoked through frameworks that inspect type hints. The `items` parameter also lacks a concrete schema for the expected list of speech segments. This prevents reliable local validation and causes malformed values to be passed directly to the remote service. ### Attack Path 1. The agent framework imports `scripts.tools`. 2. The framework inspects `generate_speech` and resolves its annotations to build a tool schema. 3. Annotation resolution encounters undefined names such as `null`, `Dict`, or `Any`. 4. Tool registration or schema generation fails. 5. The speech-generation capability becomes unavailable. Alternatively, a caller can supply malformed `items` data because no meaningful local type or structural validation is defined, potentially causing repeated upstream failures. This issue does not provide an attacker with elevated privileges or code execution. ### Impact Assessment The primary impact is loss of availability and reliability of t ...[truncated 350 chars]- Remediation
View remediation
dict[str, Any]: ... ``` 2. Define the actual required and optional fields for each speech segment rather than using an unrestricted mapping. 3. Validate that `items` is non-empty and enforce reasonable limits on: - Number of segments. - Text length. - Supported voices and roles. - Total request size. 4. Add tests that import the module, run `typing.get_type_hints`, generate the framework schema, and invoke the function with valid and invalid inputs. 5. Remove unused imports such as `Optional` and `settings` to reduce ambiguity and keep the interface maintainable. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill advertises a speech-synthesis service but documents API-key persistence to .env, local configuration handling, and unrelated service/package naming with no evidence of the claimed TTS pipeline. That discrepancy can mislead users into disclosing secrets and trusting a skill whose actual behavior and storage model differ materially from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill advertises a speech-synthesis service but documents API-key persistence to .env, local configuration handling, and unrelated service/package naming with no evidence of the claimed TTS pipeline. That discrepancy can mislead users into disclosing secrets and trusting a skill whose actual behavior and storage model differ materially from the declared purpose.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The API-key instructions and project structure mention an unrelated external service and package name, which strongly suggests the skill may send user data and credentials to a different backend than advertised. This elevates the risk of credential misuse, accidental exfiltration, and loss of user trust because the actual processing destination is obscured.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The configuration code is clearly for a different product domain ("小笨羊高考" / XBY_GAOKAO / XBY_APIKEY) than the declared speech synthesis service. This kind of skill-identity mismatch is dangerous because it can cause the deployed skill to load, retain, or transmit unrelated secrets and endpoints, indicating possible repackaging, code grafting, or hidden functionality beyond the declared purpose.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The docstrings and comments describe a different skill than the manifest, which is a strong signal of copied or substituted code. In security terms, this undermines trust boundaries because reviewers and operators may approve a speech tool while the code is configured for another service and credential set.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This code forcibly reads .env manually to extract XBY_APIKEY, bypassing normal typed settings handling and targeting a specific unrelated credential. In the context of a speech synthesis skill, this unnecessary secret harvesting increases the chance of hidden credential use, mishandling, or exfiltration by adjacent code.
- Content
python default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The code opens and reads the .env file contents directly, which is an unnecessary form of credential access for this skill and is focused on obtaining a specific unrelated API key. Direct file reads of secret material increase exposure surface and make it easier for hidden or future code paths to process credentials outside normal controls.
- Content
python def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8") for line in content.splitlines():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This function persists an API key to .env in plaintext and updates process environment state, creating durable local secret exposure. In the context of a mislabeled skill handling an unrelated credential, this becomes more dangerous because users may unknowingly authorize storage of a secret for another service entirely.
- Content
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries even though it references capabilities that can access environment variables, read/write local files, and perform network calls. In an agent setting, missing scope declarations weakens least-privilege controls and makes it easier for the skill to access secrets or modify local state beyond what a user would reasonably expect from a speech-synthesis skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill description and operational instructions are written only in Chinese, with no indication that users may choose another language or locale. This creates a language-policy concern because it implicitly constrains interaction to a specific language without documenting opt-in or a justified region-specific limitation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow documentation references unrelated gaokao school-search behavior inside a speech-synthesis skill, indicating copy-paste contamination or poor control over the prompt contract. In agent systems, irrelevant instructions can cause incorrect tool invocation, unexpected data handling, or routing user inputs to unintended functions or services.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction to directly display raw API responses can expose secrets or sensitive backend fields, including echoed API keys, internal identifiers, storage URLs, or debugging metadata. In this skill, that risk is amplified because the workflow explicitly collects and stores an API key, and the backend is an external service with unclear response sanitization guarantees.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code includes natural-language strings and docstrings exclusively in Chinese, including the class and function descriptions and the error message returned to users. Under the language/locale policy, forcing a specific language without opt-in or a documented region-specific justification is a policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code persists and manages an unrelated API key (XBY_APIKEY) even though the advertised skill is for speech synthesis. Storing credentials unrelated to the stated function expands secret exposure and suggests the skill may access another service without user understanding or operational need.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The function silently writes an API key into a local .env file without any user-facing warning, consent, or disclosure. This is risky because plaintext secrets may be left on disk, accidentally committed to source control, read by other local processes, or persist longer than the user expects.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency specifier for requests is unpinned, so builds may resolve to different versions over time. This weakens supply-chain reproducibility and can unintentionally introduce vulnerable or breaking releases into deployments.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
requests has known advisories, and because the manifest does not pin an exact version, it is impossible to verify from this file whether a safe or affected release will be installed. In a network-facing service, this uncertainty matters because HTTP client flaws can expose credentials, request integrity, or transport security.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency specifier for pydantic is unpinned, allowing future installs to pull different versions than originally tested. This creates a supply-chain risk because insecure or incompatible releases could be introduced without code changes.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
pydantic has known advisories, and the unpinned version range prevents verification that deployed environments will avoid affected releases. This can matter for services processing untrusted input because parser or validation bugs may enable denial of service or unsafe behavior.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency specifier for pydantic-settings is unpinned, which makes dependency resolution non-deterministic across environments and time. That increases exposure to accidental adoption of vulnerable releases or transitive dependency issues.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
pydantic-settings has at least one known advisory, and the lack of version pinning means the actual installed version cannot be validated from the manifest alone. For configuration-loading components, that uncertainty can affect secret handling and filesystem safety depending on how the package is used.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency specifier for python-dotenv is unpinned, so installations may vary and could silently pick up a vulnerable release. This is a common supply-chain hygiene weakness even when no active exploit is present in the file itself.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
python-dotenv has known advisories, and without an exact pin the project may install an affected version in some environments. Since this package interacts with environment and file handling, vulnerable releases could have security consequences if those features are exercised by the service.
- Content