T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:10- Finding
Configurable API Endpoint Enables Credential and User Data Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
认知增强服务
Security checks for vulnerabilities and agentic risk
Overview
The skill is an external API wrapper, but it asks for an API key, stores it in a plaintext local .env file, and can be redirected by configuration, so users should review it before installing.
Install only if you trust the Xiaobenyang service and are comfortable giving this skill an API key. Treat the key as sensitive: avoid using this in shared or synced workspaces, check whether .env could be committed or archived, and prefer a scoped or disposable key that can be rotated. Also note that the included tools.py has a syntax error, so the skill may not run as packaged.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Is Persisted in a Plaintext Workspace File Without Enforced Restrictive Permissions
- Content
View full analysis
bool: """Persist the API key to the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return False ``` ### Technical Analysis The API key is stored directly in `.env` as plaintext. `Path.write_text()` creates or replaces the file according to the process umask and existing file permissions; the implementation does not explicitly enforce owner-only permissions. The file is placed in the current working directory rather than a dedicated protected credential store. This increases the chance that it will be read by another local process, included in a workspace archive or backup, synchronized to another system, or accidentally committed to version control. The same routine also exports the key into the process environment. Child processes spawned after this assignment may inherit the credential, although no child-process execution was identified in the reviewed project. ### Attack Path 1. A user supplies a valid API key through the documented setup workflow. 2. `set_api_key()` calls `save_api_key_to_env()`. 3. The function writes `XBY_APIKE ...[truncated 1005 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a generic 'cognitive enhancement/MCP server' capability, but the content actually instructs the model to collect, persist, and use a third-party API key and manage local runtime configuration. This mismatch can mislead users and reviewers about the real trust boundary, causing them to approve a skill with credential-handling and local state mutation they did not expect.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
This code manually reads the .env file to extract XBY_APIKEY, bypassing a more controlled settings abstraction and directly handling secret material in plaintext. Manual secret parsing increases the chance of unsafe storage assumptions, accidental exposure, and inconsistent secret handling across the application.
- Content
python default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The explicit existence check and subsequent plaintext read of .env are part of direct credential handling logic. In the context of a skill not clearly scoped for local secret management, this makes credential exposure more dangerous because it normalizes local secret harvesting from a common file path.
- Content
python def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8") for line in content.splitlines():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This function is expressly designed to save an API key into a plaintext .env file, creating a durable local copy of a secret. Plaintext persistence materially increases the risk of credential compromise through source control mistakes, local multi-user access, backups, or later exfiltration by other software.
- Content
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries while the documented project structure and workflow imply access to environment variables, local file reads/writes, and networked API calls. In an agent setting, missing scope declarations increases the chance of overbroad tool access and unintended credential or filesystem exposure, especially because the skill also instructs persistence of an API key.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill name and full operating instructions are presented only in Chinese, while the embedded tool description remains in English, creating an implicit language policy that is fixed by the author rather than chosen by the user. Under the policy, forcing a specific language or locale without user opt-in is a natural-language violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document claims to provide a broad set of cognitive-enhancement tools, but the operational instructions focus on a specific external service and API-key workflow. This inconsistency is risky because it obscures the actual function of the skill, making users more likely to disclose secrets or authorize behavior under false assumptions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the model to request a user API key through natural-language interaction and then persist it via local configuration. This creates a sensitive-credential collection and retention flow that can expose secrets to logs, transcripts, prompt history, local files, or other tools, and it lacks any visible safeguards such as secure secret storage, masking, limited retention, or explicit consent for persistence.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code retrieves an API key and sends it along with the provided parameters in an outbound HTTP POST request. Although errors and success are logged, there is no confirmation prompt, print statement, or explanatory comment/docstring warning users that data and credentials will be transmitted to an external service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module persists an API key to a local .env file and updates process environment state, which is more capability than a passive configuration helper for a cognitive-enhancement skill. Persisting secrets locally can expose credentials through weak file permissions, accidental commits, workspace sharing, or later exfiltration by other components.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill implements local credential persistence despite its stated purpose being cognitive tools, increasing the attack surface without clear necessity from the manifest. This mismatch matters because users may not expect the skill to write secrets to disk, reducing informed consent and making credential leakage more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function writes the provided API key to .env immediately and silently, with no user-facing warning or confirmation. Silent secret persistence is dangerous because users may believe a key is transient while it is actually stored on disk, where it can be discovered by local users, backups, logs, or accidental repository inclusion.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency specification uses a lower-bound version constraint instead of pinning an exact version, which makes builds non-reproducible and can result in installation of unexpected or later vulnerable releases. In a service that provides model tooling, this increases supply-chain uncertainty even though the file itself does not prove exploitation.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
Requests has multiple known advisories, and because the manifest does not pin a specific version, there is no way to verify from this file alone whether deployment will use a patched or affected release. The danger is indirect but real: an environment could resolve to a vulnerable version and expose network-facing behavior to known issues.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Using pydantic>=2.7.0 allows any newer version to be installed, preventing reproducible environments and making it unclear whether a deployed build includes a vulnerable release. This is a supply-chain hygiene weakness rather than an immediate exploit by itself.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
Pydantic has known advisories, and the absence of an exact version means the risk posture cannot be verified from the manifest. In code that parses model or user-provided data, unresolved version ambiguity can expose the service to parser or validation vulnerabilities if an affected release is installed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The unpinned pydantic-settings dependency permits drift across environments and time, which can silently introduce vulnerable or incompatible versions. For infrastructure-facing tooling, this weakens dependency integrity and change control.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 81% confidence
- Finding
The manifest references pydantic-settings without pinning, while advisories exist for that package, so the deployed version may be unverifiably vulnerable. Given this library often handles configuration and secrets loading, version ambiguity can matter if affected functionality is used elsewhere in the skill.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
python-dotenv>=1.0.1 does not constrain the installed release to a specific vetted version, so builds may resolve to different packages over time, including potentially vulnerable ones. This is especially relevant for configuration-loading libraries that may touch sensitive files and environment values.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
python-dotenv has known advisories and is not version-pinned, so the environment may install an affected release without visibility in the manifest. Because dotenv tooling can read or modify configuration files, using an unverifiable version increases the chance of file-handling or configuration-related security issues.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The class and function docstrings and error text are written only in Chinese, which imposes a specific language on users without any visible opt-in or alternative. Under the language/locale policy, locale constraints should either be optional, justified, or offer user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file's human-facing docstrings and status/error text are written only in Chinese, such as the configuration description and failure message. This can amount to a language-policy issue when the skill does not offer any language choice or document that it is intentionally limited to a Chinese-speaking context.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
L31 注释描述为“强制从 .env 文件读取 XBY_APIKEY”，但类配置在 L12 指定 env_prefix 为 XBY_GAOKAO_，而手工读取与覆盖逻辑使用的是不同名称 XBY_APIKEY。该注释会让读者误以为配置来源和键名与设置体系一致，实际代码却绕过了声明的设置约定。
- Content