AWS Black Belt服务

• Outcome: Pass
• Latest audit: Jul 3, 2026 · 6:56 PM UTC
• Version: 1.0.1

Overview

The skill is a third-party AWS Black Belt seminar lookup tool that discloses its API-key requirement, but users should be aware it stores that key in a local .env file.

Install only if you are comfortable using the Xiaobenyang third-party API for AWS Black Belt seminar data. Use a limited API key if possible, avoid committing the generated .env file, and consider setting XBY_APIKEY through your environment instead of letting the skill persist it on disk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises no explicit permissions, yet its documented behavior includes reading environment variables, local file read/write, and network access. This reduces transparency and undermines least-privilege expectations, making it easier for a user or hosting platform to authorize more capability than the stated seminar-search purpose requires.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior exceeds the declared purpose: besides seminar search and transcript retrieval, it reads secrets from env/.env, persists API keys locally, and exposes broader remote tool-calling capability. This mismatch is dangerous because users may consent to a narrowly described content-search skill while unknowingly enabling credential handling and broader execution pathways.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The documentation references a different project domain ('search_schools', gaokao-related structure) than the claimed AWS seminar service, indicating copy-paste inconsistency. Such inconsistencies are risky because they can conceal unintended tool behavior, cause misrouting to unrelated functions, or mask a repurposed skill whose real capabilities differ from user expectations.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The configuration module includes API-key persistence and retrieval behavior tied to a different service identity than the declared AWS Black Belt webinar search skill. This mismatch is dangerous because it suggests copied or repurposed code that may route secrets to the wrong service context, undermining trust boundaries and increasing the chance of accidental credential misuse or hidden functionality.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: Inline docs and identifiers refer to a different skill ('小笨羊高考', 'XBY_GAOKAO') than the manifest describes. In a security-sensitive config module, this inconsistency is a red flag because operators may supply credentials under false assumptions, and reviewers cannot reliably determine which backend will receive secrets.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code persists the API key directly into a local .env file without any explicit user disclosure, consent flow, or security controls. Storing secrets in plaintext increases the risk of accidental exposure through source control, backups, logs, or multi-user filesystem access.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 96% confidence
• Finding: The code forcibly reads the .env file manually to extract XBY_APIKEY, bypassing normal typed settings behavior and increasing the chance of pulling secrets from an unexpected local file. In the context of a mismatched skill identity, this is more dangerous because it may silently consume unrelated credentials present in the working directory.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 96% confidence
• Finding: Opening and reading the entire .env file directly exposes all local secrets in process memory and bypasses safer, scoped configuration access patterns. This broad secret access is unnecessary for a simple webinar search skill and increases blast radius if the module is extended, logged, or compromised.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 97% confidence
• Finding: Creating a function whose explicit purpose is to save an API key into a plaintext .env file is a genuine secret-handling weakness. If the repository directory is shared, backed up, or accidentally committed, the key can be exposed and reused against the backing service.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 97% confidence
• Finding: The set_api_key helper persists the secret automatically as part of normal operation, making disk storage the default path rather than an informed user choice. This increases the likelihood of long-lived credential exposure for a skill that should only need runtime access to perform API calls.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower-bound only (requests>=2.31.0), which allows installation of any future version. This makes builds non-reproducible and can unintentionally introduce breaking changes or newly published malicious/compromised releases into the environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: Using pydantic>=2.7.0 without an upper bound or exact pin permits unreviewed future versions to be installed. That weakens supply-chain control and reproducibility, increasing the chance of unexpected behavior or exposure to a bad upstream release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The pydantic-settings package is unpinned, so dependency resolution may pull in different versions over time. This creates a supply-chain and stability risk because deployments may not be reproducible and can silently inherit insecure or incompatible changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: python-dotenv>=1.0.1 allows any later release to be installed, which reduces determinism and can expose the project to future vulnerable or malicious package versions. Even for configuration helper libraries, loose versioning increases supply-chain risk.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The requirement permits requests 2.31.0, and the finding cites known advisories affecting that version. In an MCP server that performs network requests, a vulnerable HTTP client is more relevant because malicious URLs, redirect behavior, or credential handling bugs could be exercised by attacker-controlled inputs or upstream content.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The requirement permits python-dotenv 1.0.1, and the cited advisory indicates a symlink-following issue in set_key that may allow arbitrary file overwrite in certain usage patterns. This is only directly exploitable if the skill actually invokes vulnerable write operations on attacker-influenced dotenv paths, which is not shown here, so the contextual risk is limited but still real at the dependency level.

Static analysis

No suspicious patterns detected.