ClawHub
Back to skill

Security audit

BBOT安全扫描服务

Security checks across malware telemetry and agentic risk

Overview

This appears to be a security-scanning skill, but its documentation and configuration are inconsistent about what service it uses and how it stores credentials.

Review this before installing. Only use it for targets you own or are authorized to scan, assume targets and scan results may be sent to an external service, and avoid providing a long-lived API key unless you are comfortable with it being stored in a local .env file. The BBOT/Gaokao/XBY inconsistencies should be fixed by the publisher before routine use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill describes capabilities that involve environment access, file read/write, and network operations, yet it declares no permissions or user-facing constraints. This creates a transparency and governance gap: users and hosting platforms may not realize the skill can persist secrets, contact remote services, and initiate scans, increasing the chance of unsafe or unauthorized use.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The documented project structure references a gaokao-related directory and components unrelated to BBOT scanning, which indicates copy-paste inconsistency and weak provenance of the skill. Such mismatches are dangerous because they undermine operator trust, make review harder, and can conceal the actual backend or data flows users are invoking.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The workflow example instructs the model to call an unrelated 'search_schools' function inside a BBOT scanning skill. This inconsistency can misroute user requests, obscure the true code path, and signals that the skill may be repurposed from another service without adequate review.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill claims to manage and execute BBOT scans, but the documentation emphasizes mandatory use of a third-party 'XBY_APIKEY' and says the code only calls an API. This discrepancy matters because users may believe scans run locally under expected controls, when in fact targets and results may be sent to an external service, changing the trust boundary and privacy risk.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The configuration code is materially inconsistent with the declared BBOT security scanning service: it references a different product/domain, different env prefix, and a different API key name. In a security-scanning skill, such mismatch is dangerous because it can route credentials or traffic to an unrelated external service, causing secret leakage, unauthorized outbound communication, or supply-chain style confusion about what backend is actually being used.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The code declares an env_prefix of XBY_GAOKAO_ but then manually reads and writes a non-prefixed variable XBY_APIKEY from .env and process environment. This inconsistency can cause operators to misunderstand which credential is in use, accidentally load the wrong secret, or bypass expected configuration controls and secret-management policies.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill enables starting BBOT security scans but does not require any user-facing warning, authorization check, or scope confirmation before launching potentially intrusive network activity. In the context of a scanning tool, this is more dangerous because users may unknowingly initiate active reconnaissance against third-party systems, creating legal, ethical, and operational risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to ask for an API key and save it, but it does not warn the user that their credential will be stored in configuration. This is dangerous because users may disclose sensitive credentials without informed consent about persistence, retention, or later reuse.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The function persists a supplied API key directly into a local .env file and process environment without warning, confirmation, or safeguards. In an agent/skill context, this can silently store long-lived credentials in plaintext on disk where they may be committed, exposed to other local users/processes, or reused unintentionally.

Ssd 3

Medium
Confidence
95% confidence
Finding
The workflow operationalizes routine solicitation, storage, and use of a user-provided API key, expanding the attack surface for credential mishandling. In a skill that also performs network operations and file/config writes, this increases the likelihood of secret leakage through logs, files, misconfiguration, or unintended reuse.

Ssd 3

Medium
Confidence
96% confidence
Finding
The skill instructs the model to directly present raw API data to the user. Scan results and raw backend responses can include sensitive information such as discovered hosts, tokens, internal metadata, stack traces, or other data that should be filtered or minimized before disclosure.

Credential Access

High
Category
Privilege Escalation
Content
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
Confidence
74% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():
Confidence
74% confidence
Finding
.env"

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
96% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
96% confidence
Finding
pydantic>=2.7.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
pydantic-settings>=2.2.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
python-dotenv>=1.0.1

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
92% confidence
Finding
requests==2.31.0

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
85% confidence
Finding
python-dotenv==1.0.1

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.