T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:36- Finding
Mandatory Remote Task Operations Hijack the Agent Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
AI代理任务管理服务
Security checks for vulnerabilities and agentic risk
Overview
The skill is a remote task-memory service, but it needs Review because it can automatically sync user task details to a third-party API and stores the API key in a plaintext .env file.
Install only if you are comfortable using xiaobenyang.com as a remote task-memory provider and with your task descriptions being sent there. Do not put secrets, private code, incident details, or personal data into todos unless the service's privacy and retention terms are acceptable. Store the API key outside a shared repository when possible, ensure .env is ignored by version control, and review the stale gaokao references and unpinned dependencies before production use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/call_api.py:47- Finding
User Task Content and API Credentials Are Transmitted to a Third Party Without Data Minimization
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:42- Finding
API Key Is Persisted in a Plaintext Environment File Without Enforced Permissions
- Content
View full analysis
bool: try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return False ``` ### Technical Analysis The API key is written directly into `.env` as plaintext. `Path.write_text()` uses ambient process permissions and does not explicitly ensure that the resulting file is accessible only by its owner. If `.env` already exists with permissive permissions, those permissions are retained. If it is newly created, its mode depends on the process umask. The write is also non-atomic. A crash during replacement can corrupt the configuration, and concurrent readers or writers can observe partial or inconsistent state. The project does not include an explicit repository exclusion rule for `.env`. ### Attack Path 1. The Skill asks the user for an API key. 2. `set_api_key()` calls `save_api_key_to_env()`. 3. The credential is written to `.env` using ambient filesystem permissions. 4. Another local user or process reads the file if those permissions permit access. 5. Alternatively, the file is accidentally copied into logs, backups, build artifacts, or version control. ### Impact Assessme ...[truncated 342 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:11- Finding
Configurable Base URL Can Redirect Credentials and Task Data to an Attacker-Controlled Endpoint
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Dependencies Use Open-Ended Version Constraints
- Content
View full analysis
=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1 ``` ### Technical Analysis All dependencies use minimum-only constraints. A future installation can therefore select package releases that did not exist when the Skill was reviewed. This makes builds non-reproducible and expands supply-chain exposure because unreviewed major or minor versions may be installed automatically. The audit did not identify a currently known malicious package, typosquatted dependency, or untrusted package source. The risk arises from allowing future, unreviewed releases rather than from confirmed malicious behavior in the named packages. ### Attack Path 1. The project is installed at a later date without a lock file. 2. The package resolver selects the newest versions satisfying the `>=` constraints. 3. A compromised, vulnerable, or behaviorally incompatible future release is installed. 4. Package installation or import executes that release in the environment hosting the Skill. 5. The affected dependency may access the same process data, files, network, and API credentials available to the Skill. ### Impact Assessment A compromised dependency executes with the privileges of the installing or hosting process. Potential scope includes access to the plaintext API key, task payloads, local files available to that process, and outbound network connectivity. Even a non-malicious incompatible release can cause availability failures or alter validation and networking behavior. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tools.py:1- Finding
Invalid and Unresolvable Type Annotations Can Break Tool Schema Generation
- Content
View full analysis
Dict[str, Any]: arguments = { } return call_api("1777419077918723", "todo_read", arguments) def todo_write( todos: null ) -> Dict[str, Any]: ``` ### Technical Analysis The module imports only `Optional`, but its annotations reference `Dict` and `Any`. The `todo_write` parameter is annotated with `null`, which is not a Python type or defined name. Because `from __future__ import annotations` is active, these annotations are initially stored as strings and do not necessarily cause the module import itself to fail. However, frameworks commonly call `typing.get_type_hints()` or otherwise resolve annotations when registering tools and generating parameter schemas. Resolution then raises `NameError` for `Dict`, `Any`, or `null`. The documented `todos` parameter is an array of structured records, but the implementation exposes no valid corresponding type. This can prevent reliable schema generation and input validation. ### Attack Path 1. A tool framework imports `scripts.tools`. 2. The framework introspects `todo_read` or `todo_write` to build the callable schema. 3. It resolves the postponed annotations. 4. Resolution encounters undefined names such as `Dict`, `Any`, or `null`. 5. Tool registration fails, making task operations unavailable; a framework with weak error handling may instead register an incomplete or unvalidated schema. ### Impact Assessment The primary impact is denial of service or unreliable tool operation. The Agent may be unable to discover or invoke the advertised task tools. If a framework silently falls back to an untyped schema, malformed task objec ...[truncated 149 chars]- Remediation
View remediation
dict[str, Any]: return call_api("1777419077918723", "todo_read", {}) def todo_write(todos: list[TodoItem]) -> dict[str, Any]: return call_api( "1777419077918723", "todo_write", {"todos": todos}, ) ``` Additionally: - Run `typing.get_type_hints()` against every exported tool during tests. - Add import, schema-generation, and invocation tests. - Validate task records at runtime before sending them externally. - Remove unused imports such as `Optional` and `settings`. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (29)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This second mismatch is more severe because the documentation suggests a generic memory/task-management service, while the project structure and instructions indicate local .env manipulation and behavior resembling a separate gaokao API integration. Such inconsistency obscures the real function of the skill and raises the risk of users providing secrets or invoking capabilities under false assumptions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This second mismatch is more severe because the documentation suggests a generic memory/task-management service, while the project structure and instructions indicate local .env manipulation and behavior resembling a separate gaokao API integration. Such inconsistency obscures the real function of the skill and raises the risk of users providing secrets or invoking capabilities under false assumptions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims to provide agent memory/task services, but the instructions pivot to an API-key-gated external service and gaokao workflow references. This is dangerous because it can socially engineer the operator into supplying credentials to a service that is unrelated to the advertised capability.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The post-init hook explicitly force-reads XBY_APIKEY from .env outside normal settings resolution, creating custom secret-loading behavior that is harder to audit and easier to misuse. In the context of a task-management skill, this secret-access logic is broader than expected and increases the chance of exposing credentials from local files.
- Content
python default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The code opens and parses the local .env file directly to extract an API key, which is credential access from local storage beyond ordinary task-management functionality. Direct secret-file parsing increases exposure and can normalize broad access to local secrets in environments where multiple tools share the same workspace.
- Content
python def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8") for line in content.splitlines():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
This function is dedicated to saving an API key into a local .env file in plaintext, which materially increases the risk of credential compromise through repo inclusion, accidental sharing, backups, endpoint compromise, or other local access. Because the skill's declared purpose does not justify local secret escrow, the context makes this behavior more suspicious and more dangerous.
- Content
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill documentation describes behaviors that imply access to environment variables, local file persistence, and networked API calls, yet it declares no explicit tool scope or permission boundaries. This weakens reviewability and can cause the host agent to grant broader capabilities than users expect, increasing the risk of secret access or unintended side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill instructions are primarily written in Chinese but include substantial English operational guidance for tool usage, with no statement that the user may choose their preferred language or that the locale restriction is intentional. This can amount to a language/locale policy issue because the skill implicitly imposes a language format without opt-in or justification.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to ask the user for an API key and persist it via local configuration without any limits on storage duration, access controls, masking, or later reuse. In the context of an agent skill, this creates a meaningful secret-handling risk: credentials may be retained, exposed to later prompts, or written to insecure locations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The workflow claims that code 'only calls APIs,' but the documented tools are local todo/session-memory operations. This inconsistency undermines trust in the security model because reviewers cannot reliably determine whether data stays local or is sent remotely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instruction to directly present raw tool data to the user bypasses any semantic filtering, least-privilege output shaping, or sensitive-field redaction. If upstream responses include secrets, internal identifiers, personal data, or debugging details, the agent may disclose them verbatim.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code sends the
paramspayload to an external API and includes an API key in the request headers, which can transmit user or system data off-box. While the code logs success and error states, it does not provide any user-facing warning, confirmation, or explanatory comment/docstring disclosing that data and credentials are being sent to a remote service.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module implements API credential persistence and retrieval even though the stated skill purpose is task/work-memory management. This expands the trust boundary by storing secrets locally in a reusable configuration file, creating unnecessary exposure if the host filesystem, repository, logs, or backups are accessed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function writes an API key into a local .env file without demonstrating that persistent local secret storage is necessary for the advertised task-management function. Persisting secrets in plaintext increases the chance of accidental disclosure through source control, backups, shared workspaces, or local compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code silently stores the API key in .env and updates the process environment without any user-facing warning, consent, or disclosure. Hidden secret persistence is risky because users may assume the key is used only transiently, while it actually remains on disk in plaintext.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency specification for requests is unpinned and allows installation of any future version above 2.31.0, making builds non-reproducible and increasing supply-chain risk. In an AI agent task-management service that likely handles network access and secrets, unexpectedly pulling a vulnerable or incompatible requests release could expose credentials or weaken transport/security behavior.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
Requests has multiple known advisories, and because the manifest does not pin a version there is no way to verify that deployed environments avoid affected releases. This is more concerning in an AI agent service because outbound HTTP is commonly used for tool access, and vulnerable requests behavior could expose credentials, mishandle redirects, or weaken request verification.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The pydantic dependency is specified with a lower bound only, so installations may resolve to different versions over time, including versions with undiscovered or known issues. Because this service likely relies on schema validation for agent memory/task data, a vulnerable or behavior-changing pydantic release could lead to validation bypasses or denial of service.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
Pydantic has known advisories, but the unpinned requirement prevents verification that only fixed versions are installed. Given this skill's role in managing structured agent/task data, a vulnerable parser or validator could be abused for denial of service or malformed input handling.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The pydantic-settings package is unpinned, which creates uncertainty about which version is deployed and whether it contains security flaws. Since settings libraries often process environment variables, config files, and secret sources, version drift can directly affect secret-handling and file-resolution behavior.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
Pydantic-settings has a known advisory related to secret/file source handling, and the lack of version pinning makes it impossible to confirm the deployed package is patched. In a memory/task management service that likely loads secrets and configuration, this can increase the risk of unsafe path or symlink resolution affecting sensitive data.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The python-dotenv dependency is not pinned, so deployments may consume different versions with different security properties. In a service likely using .env-based configuration, this increases the chance of introducing vulnerable file-handling or secret-loading behavior through normal installs or rebuilds.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1