警察数据查询服务

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:15 AM UTC
• Version: 1.0.1

Overview

The skill appears to provide the advertised police-data query functions, but it routes them through an unrelated third-party gateway and persists an API key locally with confusing copied project metadata.

Install only if you trust xiaobenyang.com with both your API key and the police-data queries you make. Treat the .env file as a stored secret, remove the key when no longer needed, and be aware that the package contains copied or inconsistent gaokao/school references that should be cleaned up before broad use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its documented behavior requires environment access, local file read/write, and network communication. This is dangerous because users and hosts cannot accurately assess or constrain what the skill can do, especially when it also handles secrets and persists them locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims to be a UK police data query service, but the documentation reveals unrelated secret collection, local persistence of the API key, and dependence on a third-party gateway unrelated to the stated function. This mismatch is dangerous because it can mislead users into disclosing credentials and permitting network/file operations they would not expect from the advertised capability.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill requires a third-party API key from xiaobenyang.com even though it presents itself as a UK police data service, and instructs the agent to collect and store that secret locally. This is a strong supply-chain and credential-harvesting red flag because the requested credential is unrelated to the declared service and may route user requests through an opaque external provider.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The workflow example invokes a school-search function that does not belong to the documented police-data toolset, indicating the skill may be repurposed from another project or incorrectly wired. Such inconsistencies are dangerous because they suggest hidden or unintended functionality, reduce trust in the documented interface, and increase the chance of accidental data exfiltration or misrouted requests.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documented project structure references a gaokao-oriented package name that conflicts with the police-data branding, which suggests code reuse from an unrelated application. In security terms, this is dangerous because it raises the likelihood of hidden dependencies, wrong endpoints, or residual logic that may send user data to unrelated services.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The client accepts attacker-controllable or caller-supplied mcp_id and tool_name values and forwards them directly as privileged headers to the upstream service using the configured API key. In the context of a skill advertised as a police-data query service, this creates a confused-deputy capability expansion: a caller may invoke arbitrary upstream MCP tools beyond the intended domain, potentially accessing unrelated data or actions under this skill's credentials.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The configuration claims to implement a UK police data query service, but hard-codes identifiers, endpoint defaults, and environment prefixes for an unrelated '小笨羊高考' service. This mismatch is a strong indicator of deceptive repurposing or supply-chain tampering, because users may provide credentials under the false belief they are for police-data access while the code is actually wired to another backend.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code persists the API key to a local .env file even though the skill description does not justify local credential storage. This creates unnecessary credential exposure through local file disclosure, accidental commits, backups, or multi-user host access, especially when users may not expect persistence for a read-only query skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function writes a supplied API key into .env without any user-facing warning, confirmation, or disclosure that the credential will be stored on disk. Silent persistence is dangerous because it defeats user expectations, increases long-term exposure of secrets, and may lead to accidental sharing via source control or support bundles.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 83% confidence
• Finding: The model_post_init method forcibly reads XBY_APIKEY directly from .env instead of relying on normal settings handling, increasing the chance of loading secrets from an unexpected local file. In the context of a mislabeled skill, this direct credential loading is more dangerous because it may silently bind user secrets to an unrelated backend.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 83% confidence
• Finding: Creating a Path('.env') and conditionally reading it is part of a custom secret-access flow that bypasses clearer framework conventions. Given the service identity mismatch in this skill, that custom logic raises the risk of silently consuming locally stored credentials for a different service than the one advertised.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 90% confidence
• Finding: This function explicitly opens and modifies .env to store an API key, which is direct credential handling with durability on disk. In a skill that presents itself as a police-data service while using unrelated service identifiers, persistent secret storage materially increases the risk of credential misuse and later compromise.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 88% confidence
• Finding: The set_api_key entry point is designed to persist credentials to .env as a normal control flow path. That makes secret storage an intended feature without clear necessity for the advertised police-query use case, increasing exposure through local compromise, accidental commits, and user confusion about where their credentials are going.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 90% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or incompatible releases from the supply chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 90% confidence
• Finding: Using an unpinned pydantic version means the environment may install any later release that satisfies the constraint, making builds non-deterministic. This increases supply-chain risk and can expose the service to newly introduced security issues without code changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 89% confidence
• Finding: The pydantic-settings package is not pinned, so installations can drift to newer releases unexpectedly. Non-reproducible dependency resolution increases the chance of pulling in a vulnerable or breaking version from the package ecosystem.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 90% confidence
• Finding: A lower-bound-only constraint for python-dotenv allows later versions to be installed without explicit review. This creates avoidable supply-chain and reproducibility risk, especially for software that may be deployed in multiple environments.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The requirements allow requests 2.31.0, which is flagged with multiple security advisories, including credential leakage and session verification issues. Because this skill is a police-data query service that likely performs outbound HTTP requests, a vulnerable HTTP client is more relevant and could expose credentials, weaken TLS/request integrity, or otherwise affect data handling.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: python-dotenv 1.0.1 is reported with an advisory involving symlink following during set_key, which can lead to arbitrary file overwrite in affected usage patterns. The impact depends on whether the skill actually calls the vulnerable write path, but carrying a known-vulnerable dependency is still a real security issue.

Static analysis

No suspicious patterns detected.