子网计算服务

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:19 AM UTC
• Version: 1.0.1

Overview

This skill needs review because it asks for and stores an API key while routing simple subnet calculations through an external service, with leftover unrelated gaokao/school-search references.

Install only if you trust xiaobenyang.com with your API key and subnet-query data. Expect the key to be saved in a local .env file in plaintext, and avoid installing this if you wanted an offline subnet calculator.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares itself as a simple subnet calculator, yet it has capabilities to read environment variables, read/write local files, and access the network without any explicit permission declaration or user-facing disclosure. This hidden capability expansion increases the attack surface and can enable silent credential access, local persistence, and exfiltration beyond what a user would reasonably expect from the stated function.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is IPv4 subnet planning, but the skill behavior includes contacting an external service, managing API keys, persisting credentials to .env, and acting as a remote proxy rather than performing local computation. This mismatch is dangerous because it can mislead users into granting secrets and network access under false expectations, undermining informed consent and trust boundaries.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The workflow example references a school-search API call in a skill advertised for subnet planning, indicating copy-paste contamination or undeclared secondary functionality. Such inconsistencies are a strong signal that the skill may route user inputs to unrelated remote services, causing unauthorized data disclosure or unexpected actions.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The project structure names the package as a gaokao/school-search skill, which conflicts with the declared subnet-calculation purpose. This inconsistency suggests repurposed or mislabeled code, making it harder to trust that the actual execution path is limited to the claimed networking utility functions.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file implements a generic remote MCP API invoker that can call arbitrary upstream tools via caller-controlled mcp_id, tool_name, and params, which exceeds the stated subnet-calculation purpose. In a skill advertised as local IPv4 planning utilities, this creates a hidden capability for external action and data transmission, increasing the risk of data exfiltration, scope creep, and abuse through unintended tool access.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code exposes a reusable mechanism to invoke any named remote tool by placing the tool name in headers and forwarding arbitrary parameters, rather than implementing only subnet-specific logic. That mismatch makes the skill more dangerous because the published functionality does not signal that it can act as a general remote tool proxy.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This subnet-calculation skill includes logic to accept, persist, and expose an external service API key in a local .env file, which is unrelated to the advertised IPv4 planning functionality. That creates unnecessary secret-handling capability and increases the chance of credential leakage through local file disclosure, workspace syncing, backups, or later code paths that read the same file.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code forcibly reads XBY_APIKEY from .env and the process environment even though the skill is described as a subnet-planning tool. Hidden credential-loading behavior outside the skill's stated purpose is risky because it silently expands the trust boundary and may harvest secrets present in the user's environment or project directory.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the model to solicit an API key from the user and store it, but does not warn about where the credential will be kept, how long it persists, or who can access it. Collecting secrets through natural-language interaction without clear consent and handling guarantees creates unnecessary credential theft, leakage, and reuse risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The outbound request forwards arbitrary params together with an API key to an external service, but this file contains no constraints, redaction, or user-notice mechanism around what data may leave the environment. If user-supplied or sensitive context is placed into params elsewhere, this becomes an exfiltration path to a third party.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function writes an API key to .env without any visible confirmation, warning, permission check, or secure storage control. Silent persistence of secrets can surprise users and leave credentials exposed to accidental commit, local disclosure, or reuse by unrelated processes that read the same project environment.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill operationalizes secret collection and persistence as part of the LLM workflow, telling the model to obtain a user-provided API key and save it locally. Embedding credential handling into conversational instructions is dangerous because it normalizes secret sharing with the model and increases the chance of unsafe storage, accidental logging, or misuse.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the model to present raw API response data directly to the user without filtering or review. If the remote service returns sensitive metadata, debugging details, reflected secrets, or unexpected content, the skill can disclose it verbatim and bypass normal output-safety controls.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 92% confidence
• Finding: The code explicitly and forcibly reads XBY_APIKEY from .env during initialization, outside the normal scoped env_prefix behavior and without user awareness. In a subnet utility, this is contextually suspicious and dangerous because it adds credential access functionality unrelated to the advertised task, increasing the chance of unintended secret capture.

Credential Access

High

• Category: Privilege Escalation

Content

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

• Confidence: 91% confidence
• Finding: Reading XBY_APIKEY from the process environment and assigning it into application state accesses a credential unrelated to the stated subnet-planning function. In this context, that broadens the attack surface and may cause the skill to consume sensitive secrets present in the execution environment without a clear user need.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 94% confidence
• Finding: This function is dedicated to saving an API key into .env, creating long-lived plaintext secret storage in the project directory. Plaintext persistence materially increases exposure through local file reads, backups, sync tools, and accidental repository inclusion, especially for a tool whose declared purpose does not require credential management.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 90% confidence
• Finding: The function explicitly advertises setting and persisting an API key to .env, reinforcing unnecessary secret-management behavior within a subnet calculator. While not exfiltration by itself, it normalizes insecure credential storage and can lead users to place sensitive tokens in project files that are easier to leak.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower-bound constraint only, which allows future unreviewed versions to be installed and also permits resolution to currently vulnerable versions such as requests 2.31.0. For a network-oriented MCP service, dependency behavior matters because HTTP client libraries may process attacker-controlled URLs, redirects, proxies, or credential sources.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 91% confidence
• Finding: Using an unpinned pydantic version makes builds non-reproducible and can introduce breaking or insecure transitive changes without review. While this is less directly exploitable than a known vulnerable package, it weakens supply-chain control for the service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 90% confidence
• Finding: An unpinned pydantic-settings dependency allows uncontrolled upgrades that may introduce vulnerable or incompatible versions. In a service likely loading configuration from environment or .env sources, config-parsing libraries are security-relevant and should be tightly managed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 94% confidence
• Finding: python-dotenv is unpinned, enabling installation of different versions across environments, including versions with known issues such as the flagged 1.0.1 advisory. Because this library can read or modify environment-related files, version control is important for limiting supply-chain and local file-handling risk.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The dependency set permits requests 2.31.0, which has multiple published advisories, including issues around .netrc credential leakage and Session verification behavior. In an MCP service, even if the core purpose is subnet calculation, any outbound HTTP use can become a security boundary if attacker-influenced URLs, redirects, or auth contexts are involved.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: python-dotenv 1.0.1 is reported with a symlink-following issue in set_key that could enable arbitrary file overwrite in affected usage patterns. This service context does not inherently require writing dotenv files, so exploitability depends on whether set_key or similar mutation features are used, but the vulnerable version remains a real supply-chain risk.

Static analysis

No suspicious patterns detected.