Wikimedia图片搜索服务

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:21 AM UTC
• Version: 1.0.1

Overview

The skill appears to provide image search, but it uses a third-party backend and stores an API key locally in ways that are not clearly scoped or disclosed enough for automatic approval.

Install only if you are comfortable using the third-party backend and storing its API key locally. Prefer a dedicated, least-privilege key, check that .env files are not committed or shared, and rotate the key if you later uninstall or no longer trust the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes reading environment variables, writing to local files (.env), and making network requests. This is dangerous because it hides the true trust boundary from users and reviewers, making credential handling and external data flows less visible and harder to audit.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims to search Wikimedia Commons, but its instructions reveal dependence on a third-party 'xiaobenyang.com' service, local credential access, and credential persistence. This mismatch is dangerous because users may believe they are interacting only with Wikimedia while actually sending requests and secrets through an undisclosed external provider.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to collect an API key from the user and save it locally without warning about storage location, retention, or exposure risks. This is dangerous because users may disclose sensitive credentials without understanding they will be persisted to disk, potentially accessible to other local processes or future sessions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code persists an API key to a local .env file automatically, without any user confirmation, warning about plaintext storage, or file-permission hardening. This increases the risk of accidental secret exposure through source control, backups, shared workspaces, or other local processes that can read the file.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound (`requests>=2.31.0`), which permits installation of different versions over time and makes builds non-reproducible. This increases supply-chain and stability risk because future vulnerable or incompatible releases may be pulled without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The dependency is unpinned (`pydantic>=2.7.0`), so environments may resolve to different versions at different times. This weakens reproducibility and can introduce unreviewed security or breaking changes from upstream releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: Using `pydantic-settings>=2.2.0` without an upper bound or exact pin allows arbitrary newer versions to be installed. That creates supply-chain exposure and can unexpectedly introduce vulnerabilities or incompatible behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The package `python-dotenv>=1.0.1` is unpinned, which means dependency resolution may change over time and pull in unreviewed releases. This is a common supply-chain hygiene issue that can increase risk even if no immediate exploit exists in this file alone.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The finding correctly notes that `requests` 2.31.0 has published security advisories. In a Wikimedia image search service that performs outbound HTTP requests, a vulnerable HTTP client is relevant because flaws such as credential leakage, verification issues, or unsafe helper behavior can affect request handling, especially if attacker-controlled URLs or sessions are ever involved.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The dependency `python-dotenv` 1.0.1 is reported with an advisory involving symlink following in `set_key`, which can enable arbitrary file overwrite if that API is used unsafely. The package manifest alone does not prove the vulnerable function is reachable, so the practical risk is lower here, but keeping a dependency with a known advisory is still a genuine security issue.

Static analysis

No suspicious patterns detected.