T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:10- Finding
API Credential Can Be Redirected to an Attacker-Controlled Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
AI人格服务
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a real remote persona-service wrapper, but it asks users for an API key and stores it insecurely in a local plaintext .env file.
Install only if you are comfortable giving this skill a XiaoBenYang API key and having that key sent to the remote MCP service. Prefer configuring the key through a trusted secret manager or environment outside chat, ensure any .env file is private and excluded from git/backups, and avoid overriding the API base URL unless you fully trust the destination.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:40- Finding
API Key Is Persisted in a Plaintext File Without Explicit Permission Hardening
- Content
View full analysis
bool: try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True ``` ### Technical Analysis The Skill persists the API key directly in a `.env` file as plaintext. The code uses `Path.write_text()` without explicitly creating the file with owner-only permissions or checking the permissions of an existing file. The resulting access permissions depend on the process umask and any permissions already assigned to `.env`. The update is also not atomic, which can temporarily expose incomplete configuration and creates avoidable file-handling risk. Because the file is placed in the current working directory, it may also be unintentionally included in source-control commits, workspace archives, backups, or diagnostics. ### Attack Path 1. The user supplies an API key as directed by the Skill. 2. `set_api_key()` calls `save_api_key_to_env()`. 3. The key is written as `XBY_APIKEY=` in the working directory's `.env` file. 4. A local process or user capable of reading that file obtains the plaintext credential. Alternatively, the file is accidentally included in a repository, archive, backup, or support bundle. 5. The exposed key is reused against the upstream API. ...[truncated 551 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Dependencies Are Not Reproducibly Pinned
- Content
View full analysis
=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1 ``` ### Technical Analysis Every dependency specifies only a minimum version. A future installation may therefore resolve to package versions that were not present or reviewed when the Skill was audited. This weakens build reproducibility and increases exposure to future compromised releases, regressions, or incompatible changes. The inspected dependency names correspond to established packages, and the audit found no evidence that the currently declared packages are malicious. The risk arises from unrestricted future dependency resolution rather than a confirmed malicious dependency. ### Attack Path 1. A future package release satisfying a `>=` constraint is compromised or contains a security regression. 2. The Skill is installed or rebuilt without a reviewed lockfile. 3. The package resolver selects the affected release. 4. Malicious or vulnerable package behavior executes during installation, import, or runtime. 5. The resulting impact occurs with the privileges of the process installing or running the Skill. ### Impact Assessment The potential impact depends on the affected dependency and execution context. A compromised dependency could access the Skill process's files, environment variables, API key, and network permissions. If installation is performed with elevated privileges, the scope could be correspondingly larger. No current dependency compromise was established during this source audit; this is a supply-chain hardening issue. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The document claims to provide a multi-persona MCP collaboration service, but its structure and instructions point to unrelated high-school exam tooling and local API-key persistence. This mismatch is dangerous because it can mislead users and reviewers about what the skill really does, masking sensitive credential handling and broader capabilities not disclosed in the description.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
The code manually parses .env and force-loads a secret key outside the normal typed settings flow, creating a second secret-loading path that may bypass expected validation and secret-handling controls. In an agent skill context, direct local file secret access increases risk because the component is explicitly designed for multi-agent collaboration, making accidental propagation or misuse of loaded credentials more dangerous if other parts of the system can access the resulting settings object.
- Content
python default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
Opening and reading the .env file directly exposes all file contents to application code, which is broader access than necessary when only one secret is needed. In a multi-persona/agent server, any later bug, debug print, exception path, or object sharing could leak secrets that were unnecessarily brought into process memory from a local credential store.
- Content
python def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8") for line in content.splitlines():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
This function persists an API key in plaintext to a local .env file and mirrors it into process environment variables, increasing the exposure window and the number of places the secret may be recovered. In the context of an agent skill/server, storing credentials this way is more dangerous because such systems often run with plugins, shared workspaces, logs, backups, or multiple operators, any of which can lead to unauthorized secret disclosure.
- Content
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries despite documented capabilities that include environment access, file read/write, and network usage. In an agent setting, missing scope declarations increase the chance of over-privileged execution and make it harder for users or hosting platforms to constrain sensitive operations such as secret persistence and outbound API calls.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the model to ask the user for an API key and then save it locally. Normalizing conversational collection and persistence of secrets is risky because it encourages users to disclose credentials in chat and creates a local secret-storage path that may be exposed to logs, other tools, or unintended file access.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow reiterates that the model must solicit and persist the user's API key before proceeding, reinforcing secret-collection behavior as a required operating pattern. Repetition increases the likelihood that agents will request credentials even in unsafe contexts and store them insecurely, broadening the chance of leakage or misuse.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The project structure and documentation reference gaokao-related modules while the skill is presented as an AI persona service. Internal contradictions like this reduce trustworthiness and can conceal unexpected behavior, making security review and safe deployment significantly harder.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
L09 的类文档字符串写的是“"小笨羊高考Skill配置"”，而当前技能清单声明的名称与用途是“AI人格服务”，用于多AI人格召唤与协作。该注释不是简单遗漏，而是明确表述了一个不同的技能意图，和本文件中实际配置的远程服务/API key 逻辑一起看，会误导审计者对该技能真实目的的判断。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The class docstring is written as Chinese-only text ("小笨羊高考Skill配置"), indicating a language-specific presentation without any visible option or note allowing the user to choose another language. The policy for this audit flags natural-language locale constraints when they are imposed without opt-in or justification visible in the file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing natural-language docstrings are written entirely in Chinese, including action descriptions and persona examples, with no indication that another language is supported or that Chinese is required for a specific regional purpose. This can violate language/locale policy because the skill presents a single forced language without opt-in or documented justification.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency uses a lower-bound specifier (requests>=2.31.0) rather than an exact pinned version, which makes builds non-reproducible and can cause the environment to resolve to an unexpected or newly introduced vulnerable release. In a network-facing AI/MCP service, requests is commonly used for outbound HTTP, so supply-chain drift can affect runtime security and reliability.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The manifest does not pin requests, and the package has multiple known advisories across versions, so it is impossible to verify from this file whether deployments are using a safe release. Given that requests is typically used for external HTTP interactions, an affected resolved version could expose credential leakage, TLS/session issues, or other client-side security weaknesses.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
pydantic>=2.7.0 is unpinned, so installations may resolve to different versions over time, preventing reproducible builds and making it harder to verify whether a deployed version contains known vulnerabilities. Because pydantic processes structured input and configuration, unexpected version changes can alter validation behavior in security-relevant ways.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
Because pydantic is unpinned and has known advisories in some versions, the security posture of the installed package cannot be verified from this requirements file alone. For a service that validates untrusted input, using an affected version could lead to denial-of-service or unsafe parsing behavior.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
pydantic-settings>=2.2.0 allows dependency resolution to float to newer versions without review, which creates a supply-chain and reproducibility risk. Since this package handles application settings, version drift can affect secret loading and configuration parsing in ways that may expose or mishandle sensitive data.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
The file allows any pydantic-settings version at or above 2.2.0, but known advisories exist for some releases, making the actual deployed risk unverifiable. Since this library manages settings and potentially secrets sources, a vulnerable version could impact confidentiality or integrity of configuration handling.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
python-dotenv>=1.0.1 is not pinned, so future installs may pull different releases, including ones with unresolved advisories or behavior changes. In an AI service that may rely on environment-based secrets, uncontrolled upgrades to dotenv-related tooling can increase risk around configuration and secret management.
- Content
text requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
python-dotenv has known advisories in some versions, and the unpinned requirement prevents verification that deployed environments avoid affected releases. Because dotenv tooling often reads and writes files tied to environment secrets, a vulnerable version could contribute to file overwrite or secret-handling issues depending on usage.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The class docstring is written only in Chinese, and additional user-facing exception and status messages in this file are also Chinese-only. Under the stated policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The raised error message "API密钥未设置，请先调用 set_api_key()" is user-facing and provides no language choice. This violates the language/locale policy unless the skill explicitly documents that it is intended only for Chinese-language usage.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The function docstring and especially the returned message "API调用失败" are part of the user-visible interface and are hardcoded in Chinese. The policy requires either user choice of language or documented justification for a fixed locale.
- Content