Security audit

BBOT安全扫描服务

Security checks for vulnerabilities and agentic risk

Overview

This BBOT scanner wrapper needs review because it asks for and stores an external service API key while carrying unrelated XiaoBenYang/Gaokao configuration and proxying scan data to a configurable external endpoint.

Install only if you trust the XiaoBenYang service and understand that your API key and scan targets/options will be sent to that external API. Use it only for systems you are authorized to scan, avoid storing sensitive keys in a shared workspace .env file, and review or constrain the base URL and dependency versions before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/call_api.py:51
Finding: Configurable API Endpoint Can Expose Credentials and Scan Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config.py:42
Finding: API Key Is Persisted in a Predictable Plaintext File Without Enforced Access Controls
Content: View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The API key is written as plaintext to a predictable `.env` path in the process's current working directory. The implementation relies on ambient operating-system permissions and the current umask; it does not explicitly enforce owner-only access such as mode `0600`. The implementation also does not check whether `.env` is a symbolic link or ensure that the resolved path is an expected regular file. Existing file permissions are not hardened before or after the write. No repository-level `.gitignore` was present in the audited directory structure to reduce the risk of accidental credential commits. Plaintext secret storage increases exposure through local file access, backups, workspace collection, support bundles, and accidental source-control operations. ### Attack Path 1. The user supplies an API key as required by the Skill workflow. 2. `set_api_key()` calls `save_api_key_to_env()`. 3. The API key is stored as `XBY_APIKEY=` in the current direct ...[truncated 950 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unbounded Dependency Versions Allow Unreviewed Future Releases
Content: View full analysis
=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1 ``` ### Technical Analysis All dependencies use open-ended minimum-version constraints. A future installation can therefore resolve to versions that did not exist when the Skill was reviewed. The project provides no lock file or integrity hashes to establish a reproducible, verified dependency set. No typosquatted package name, custom package index, or known malicious package was identified in the audited files. The risk arises from unrestricted future resolution: a compromised upstream release, maliciously altered distribution, or incompatible future version could be installed without a source-code change to this project. ### Attack Path 1. The project is installed or rebuilt at a later date. 2. The package resolver selects the newest releases satisfying the `>=` constraints. 3. An upstream package or distribution channel has been compromised, or an unreviewed release contains exploitable behavior. 4. The selected package is downloaded and installed. 5. The dependency's code executes during import or normal Skill operation with the privileges of the hosting process. ### Impact Assessment A compromised dependency executes within the Skill's Python process and may access the same files, environment variables, API credentials, and network resources available to that process. This could expose the API key or alter tool behavior. The practical likelihood is reduced because the listed package names correspond to established packages and no malicious source configuration was found. The issue primarily affects supply-chain integrity and build reproducibility. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill presents itself as a BBOT scanner but references configuration and API-key handling for an unrelated service/project, including .env persistence and non-BBOT settings. This is especially risky in a security-scanning context because users may provide credentials or authorize actions believing they are for BBOT operations when they are actually for a different external service.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a BBOT scanner but references configuration and API-key handling for an unrelated service/project, including .env persistence and non-BBOT settings. This is especially risky in a security-scanning context because users may provide credentials or authorize actions believing they are for BBOT operations when they are actually for a different external service.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation for a BBOT security-scanning skill is contradicted by instructions to collect and store an API key for a different service. Contradictory instructions around credentials are dangerous because they create a phishing-like pattern: the user is asked for a secret that is not clearly necessary for the advertised function.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow example references school-search behavior and generic API passthrough rather than BBOT-specific scanning logic, showing the skill instructions were likely copied from another domain. This mismatch makes the skill less trustworthy and increases the likelihood of unsafe routing, incorrect tool use, and accidental disclosure of user inputs to irrelevant backends.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file claims to belong to a BBOT security scanning service, but the code and comments are clearly for a different product ('小笨羊高考') and use unrelated identifiers such as XBY_GAOKAO_ and xiaobenyang.com. This mismatch is a strong supply-chain integrity concern because operators may believe they are deploying BBOT functionality while actually loading code tied to another service and credential namespace.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.
python
model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The code explicitly reads the .env file itself and extracts XBY_APIKEY outside the normal settings flow, creating an additional secret-handling path that may bypass expected validation and auditability. In the context of a security-scanning skill, extra credential collection logic is more sensitive because operators may grant elevated trust and provide privileged tokens.
Content: Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.
python
default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: Checking for and reading a local .env file is not malicious by itself, but here it is part of explicit credential extraction logic targeting XBY_APIKEY. This enlarges the attack surface for secret exposure and makes it easier for unrelated code in the package to harvest credentials from disk.
Content: Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.
python
def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8") for line in content.splitlines():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.
python
if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: This function writes the API key into a plaintext .env file, creating a durable secret at rest that may be readable by other local users, backups, tooling, or accidentally committed to source control. Because this is packaged as a security-related service, users may supply sensitive scanner credentials, making plaintext persistence especially risky.
Content: Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.
python
def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no explicit tool scope or permission boundaries even though it is documented as using environment access, file reads/writes, and networked API calls. In an agent setting, missing scope declarations increase the chance of over-privileged execution and make it harder for users or platforms to constrain sensitive actions like credential storage and outbound requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill can initiate active security scans against user-specified targets but does not include a clear warning, authorization check, or consent language before launching scans. In a security tool context, that omission is important because active scanning can be disruptive, unauthorized, or legally sensitive if run against systems the user does not control.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction to directly present result["raw"] to the user can expose sensitive information returned by the backend, including user-submitted targets, tokens, internal metadata, or scan artifacts that were not meant for broad display. In a networked scanning tool, raw backend responses frequently contain more detail than should be surfaced verbatim.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented project structure names a different project and external API client components, contradicting the claimed BBOT identity of the skill. In aggregate with the other inconsistencies, this materially increases the risk that users are interacting with a mislabeled wrapper that sends data or secrets to an unintended backend.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code accesses a sensitive credential via get_api_key() and transmits it in the XBY-APIKEY header during the outbound POST request. Although errors and successes are logged, there is no confirmation prompt, user-facing notice, or explanatory comment/docstring warning that a credential will be used and sent to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The helper persists API keys directly into a local .env file and also exports them into the process environment without any warning, consent flow, or file-permission hardening. This increases the chance of secret exposure through source control, backups, local file disclosure, or accidental sharing on multi-user systems.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
modules: Comma-separated list of modules to use (optional) presets: Comma-separated list of presets to use (optional) flags: Comma-separated list of flags to use (optional) no_deps: Disable dependency installation to prevent sudo prompts (default: True) Args:

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
modules: Comma-separated list of modules to use (optional) presets: Comma-separated list of presets to use (optional) flags: Comma-separated list of flags to use (optional) no_deps: Disable dependency installation to prevent sudo prompts (default: True) Args:

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/tools.py (reported line 54)May include surrounding context.
python
modules: Comma-separated list of modules to use (optional) presets: Comma-separated list of presets to use (optional) flags: Comma-separated list of flags to use (optional) no_deps: Disable dependency installation to prevent sudo prompts (default: True) Args:

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with a lower bound only, so builds may resolve to different versions over time. This weakens supply-chain control, makes security posture non-reproducible, and can accidentally introduce vulnerable or breaking releases.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: Requests has multiple known advisories, and because the manifest does not pin a version, it is impossible to verify whether deployed environments avoid affected releases. In a network-facing security scanning service, an unresolved HTTP client dependency can materially increase exposure to credential leakage or TLS/request-handling flaws.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with a lower bound only, so installations are not reproducible and may pull in unexpected future versions. In a security-oriented service, this increases supply-chain risk because behavior and vulnerability exposure can change without code changes.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 77% confidence
Finding: Pydantic has published advisories, and the unpinned version prevents confirming whether the installed release is patched. This creates avoidable uncertainty in a core parsing/validation library that could expose denial-of-service or input-handling weaknesses.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: Using an unpinned version allows the installed pydantic-settings release to vary across environments and over time. That makes it harder to verify whether known advisories are addressed and increases the chance of pulling a risky release.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1

Static analysis

No suspicious patterns detected.