ClawHub
Back to skill

Security audit

Celo服务

Security checks for vulnerabilities and agentic risk

Overview

This skill is labeled as a Celo setup helper but asks for and stores a XiaoBenYang API key and sends requests to a separate remote service.

Review this carefully before installing. Only use it if you intentionally want to use the XiaoBenYang service, are comfortable storing that service's API key in a local .env file, and accept that your tool queries and parameters will be sent to the configured remote API endpoint. Do not provide unrelated Celo, wallet, exchange, or personal credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/call_api.py:51
Finding

Configurable API Endpoint Can Exfiltrate Credentials and User Data

Content
View full analysis

Vulnerability Details

File Location: scripts/config.py:9-14; scripts/call_api.py:51-67
Vulnerability Type: Credential disclosure through an unvalidated configurable endpoint
Risk Level: High

Vulnerable Code

python
# scripts/config.py:9-14
model_config = SettingsConfigDict(
    env_prefix="XBY_GAOKAO_",
    env_file=".env",
    env_file_encoding="utf-8",
    extra="ignore",
)
python
# scripts/config.py:17
base_url: str = "https://mcp.xiaobenyang.com"
python
# scripts/call_api.py:51-67
url = f"{settings.base_url}/api"
mcp_id = mcp_id or settings.mcp_id

api_key = get_api_key()
if not api_key:
    raise UpstreamError("API密钥未设置，请先调用 set_api_key()")

headers = {
    "XBY-APIKEY": api_key,
    "func": tool_name,
    "mcpid": mcp_id,
    "Content-Type": "application/json",
}

# data = {k: str(v) if v is not None else "" for k, v in params.items()}

t0 = time.time()
try:
    resp = self._session.post(
        url=url,
        headers=headers,
        data=json.dumps(params),
        timeout=settings.timeout_seconds,
    )

Technical Analysis

The Settings class permits configuration values to be supplied through environment variables with the XBY_GAOKAO_ prefix. Consequently, base_url can be overridden using XBY_GAOKAO_BASE_URL.

The HTTP client constructs the API URL directly from this configurable value and unconditionally adds the XBY-APIKEY credential to the request. It does not verify that the scheme is HTTPS or that the destination hostname is the expected mcp.xiaobenyang.com service.

An attacker who can influence the process environment or .env configuration can therefore redirect authenticated requests to an attacker-controlled server. The credential and all tool parameters will then be disclosed to that server.

Attack Path

  1. The attacker gains the ability to influence the Skill's runtime environment or configuration file.
  2. The attacker sets XBY_GAOKAO_BASE_URL to an attacker-controll ...[truncated 1028 chars]
Remediation
View remediation

Remediation Suggestions

  1. Keep the authenticated API origin fixed in code when runtime customization is not required.
  2. If endpoint configuration is required, parse the URL and enforce:
    • The https scheme.
    • An exact allowlisted hostname.
    • An expected port.
    • Rejection of embedded credentials, fragments, and unexpected paths.
  3. Validate the final request URL immediately before attaching the API key.
  4. Do not forward credentials across redirects. Disable redirects or verify every redirect destination against the same allowlist.
  5. Separate development endpoint overrides from production builds and never send production credentials to development endpoints.
  6. Add automated tests confirming that HTTP URLs, unapproved hosts, subdomain lookalikes, and redirect-based destination changes are rejected.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/config.py:42
Finding

API Key Is Persisted in a Plaintext File Without Explicit Access Controls

Content
View full analysis

Vulnerability Details

File Location: scripts/config.py:42-62
Vulnerability Type: Insecure plaintext storage of sensitive credentials
Risk Level: Medium

Vulnerable Code

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
        found = False
        new_lines = []
        for line in lines:
            if line.startswith("XBY_APIKEY="):
                new_lines.append(f"XBY_APIKEY={api_key}")
                found = True
            else:
                new_lines.append(line)
        if not found:
            new_lines.append(f"XBY_APIKEY={api_key}")
        env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8")
        os.environ["XBY_APIKEY"] = api_key
        return True
    except Exception as e:
        print(f"保存API key失败: {e}")
        return False

Technical Analysis

The API key is written in plaintext to a relative .env file in the current working directory. The implementation relies on default filesystem behavior and the process umask rather than explicitly creating the file with owner-only permissions.

The code also performs no validation that .env is a regular file. Path.write_text() follows symbolic links, so a locally placed .env symlink could cause the credential to be written to another file accessible to the attacker. The relative path also makes the storage location dependent on the directory from which the Skill is launched.

Plaintext .env files are additionally susceptible to accidental source-control commits, workspace archiving, backup collection, and access by other processes that can read the project directory.

Attack Path

A local disclosure path is:

  1. The Skill runs in a directory whose files are accessible to another local user or process.
  2. The Skill asks the user for an API key ...[truncated 1071 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer an operating-system credential manager or keychain instead of a plaintext project file.
  2. If persistence is unnecessary, retain the key only in process memory or require it through a protected environment variable.
  3. If file storage must be supported:
    • Use a fixed, trusted user configuration directory rather than the current working directory.
    • Reject symbolic links and verify that an existing destination is a regular file owned by the current user.
    • Create the file atomically with owner-only mode 0600.
    • Preserve restrictive permissions when updating the file.
    • Avoid time-of-check/time-of-use races by using secure low-level file-opening flags where supported.
  4. Ensure .env is excluded from source control, archives, diagnostic bundles, and logs.
  5. Inform the user that the key will be persisted and provide a session-only configuration option.
  6. Support key removal and recommend immediate credential rotation if the file may have been exposed.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Open-Ended Dependency Constraints Allow Unreviewed Future Releases

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: Non-reproducible and insufficiently constrained dependency installation
Risk Level: Low

Vulnerable Code

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Technical Analysis

All dependencies use open-ended minimum-version constraints. A fresh installation may therefore resolve to versions published after the project was audited. The project contains no lockfile or package hashes to ensure that installations use the same reviewed artifacts.

No malicious package is proven to be present in the currently listed dependencies. The security concern is that future compromised, vulnerable, or incompatible releases can enter the environment automatically without a corresponding review of this Skill.

Because dependencies execute within the Python process, a compromised dependency can generally act with the same filesystem, network, environment-variable, and process privileges as the Skill.

Attack Path

  1. A future dependency release is compromised, malicious, or contains a security vulnerability.
  2. The package remains compatible with the open-ended >= constraint.
  3. A user installs the Skill in a new environment or rebuilds an existing environment.
  4. The package resolver selects the unreviewed release.
  5. The dependency's installation or runtime code executes with the privileges of the Skill process.
  6. Depending on the dependency defect, sensitive environment values, the stored API key, local files, or network access may be exposed.

Impact Assessment

The precise impact depends on the behavior of a future affected dependency. At maximum, malicious dependency code could access the same files, environment variables, credentials, and network resources available to the Skill process.

This is a supply-chain hardening issue rather than evidence that the dependencies currently specified are malicious. It does not, by ...[truncated 57 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct and transitive dependency to reviewed versions using a lockfile.
  2. Use hash verification, such as pip's --require-hashes, to ensure downloaded artifacts match approved files.
  3. Generate pinned requirements through a controlled tool such as pip-compile and commit the generated lock data.
  4. Perform vulnerability and provenance checks before dependency updates.
  5. Automate update proposals while requiring review and security testing before merging.
  6. Install packages only from explicitly trusted package indexes and prevent unintended fallback to untrusted sources.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The file advertises Celo Composer Kit setup functionality, yet the documented internals focus on generic API-client settings, .env credential persistence, and communication with xiaobenyang.com / XBY Gaokao infrastructure. This discrepancy increases the risk of phishing-like credential capture and unauthorized network/data flows because operators cannot reliably infer real behavior from the skill declaration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The file advertises Celo Composer Kit setup functionality, yet the documented internals focus on generic API-client settings, .env credential persistence, and communication with xiaobenyang.com / XBY Gaokao infrastructure. This discrepancy increases the risk of phishing-like credential capture and unauthorized network/data flows because operators cannot reliably infer real behavior from the skill declaration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The embedded workflow explicitly pivots from a purported Celo skill to an API-key-gated XBY/gaokao service, including instructions to solicit and store a secret from the user. In context, this looks more suspicious than a simple documentation error because it operationalizes secret collection for an unrelated service inside a differently branded skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The project structure references xiaobenyang_gaokao_skill and an API-calling architecture inconsistent with the advertised Celo MCP installer. This contradiction strongly suggests the skill content was copied from or intentionally repointed to a different service, which undermines trust and can conceal secret exfiltration or misleading remote actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The implementation is explicitly built as a client for a remote XiaoBenYang MCP API, while the manifest claims the skill installs and configures a local Celo Composer Kit MCP server. This mismatch is dangerous because it can mislead users into granting trust, credentials, and network access to a component that performs undisclosed remote operations against an unrelated service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The configuration code clearly targets a different product/domain than the declared Celo skill: it uses XBY/Gaokao-specific prefixes, API key names, comments, and endpoints. This kind of skill/manifest mismatch is dangerous because it can cause the agent to load and operate unrelated remote services or secrets under false pretenses, undermining user trust and increasing the chance of hidden data exfiltration or unauthorized service interaction.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python
model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python
model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

This function writes the provided API key into a plaintext .env file, creating a durable local copy of a secret that may be exposed through source control mistakes, permissive filesystem access, or other local tooling. In the context of a mismatched skill that already appears to target an unrelated backend, silent secret persistence is more dangerous because users may provide credentials under false assumptions about the service they are authorizing.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares no explicit tool scope or permission boundaries even though its documented behavior involves environment access, file reads/writes, and network access. In an agent setting, missing scope declarations can lead to over-privileged execution and make it harder for users or orchestrators to constrain sensitive operations such as credential storage and outbound requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The docstrings repeatedly describe calls to the XiaoBenYang MCP API, directly contradicting the manifest's Celo-specific functionality. Such contradictory labeling is a social-engineering red flag because it obscures the true behavior of the skill and can cause reviewers or users to trust and deploy software under false assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code includes Chinese-only docstrings and error/message strings such as the client description and API failure text, with no indication that the skill is region-specific or that users can opt into another language. That creates a natural-language locale policy issue because the skill effectively enforces one language in user-visible outputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code performs arbitrary outbound POST requests to a configurable upstream endpoint using an API key, yet the stated purpose is only local installation and configuration. In this context, hidden remote invocation expands the attack surface for data exfiltration, unauthorized actions on behalf of the user, and covert command brokering to external infrastructure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The docstrings and inline comments describe XBY/Gaokao-specific behavior instead of Celo functionality, which contradicts the published skill purpose. In security terms, contradictory intent signals raise the risk of deceptive packaging, operator confusion, and accidental exposure of secrets to an unintended backend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code persists an API key to a local .env file automatically without any user-facing disclosure, consent, or storage-scope warning. That increases the chance of secret leakage through accidental commits, weak file permissions, shared workspaces, backups, or later access by other local processes/tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill content is presented in a fixed combination of Chinese and English, including mandatory operational instructions in Chinese and tool descriptions in English. This can impose a language/locale experience on users without explicit opt-in or a stated language-selection mechanism, which matches the language-policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified with a lower bound only (requests>=2.31.0), which makes builds non-reproducible and can allow unexpected or vulnerable future releases to be installed. In a tool that installs/configures other components, this increases supply-chain risk because behavior and security posture can change over time without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The manifest does not pin requests, so it is impossible to determine whether the installed version includes fixes for known advisories. This creates uncertainty around exposure and can leave users silently installing a vulnerable release depending on resolver behavior and time of installation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

pydantic>=2.7.0 is unpinned, so installations may resolve to different versions over time, including versions with undiscovered or newly disclosed flaws. This weakens reproducibility and makes it harder to verify that deployed environments are using a reviewed dependency set.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

Because pydantic is not pinned, the package version cannot be matched confidently against known advisories, leaving security status unverifiable. For a configuration-heavy tool, uncertainty in validation library security can matter if malicious input is processed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

pydantic-settings>=2.2.0 permits any newer version, which can introduce insecure or incompatible changes without explicit approval. Because this package handles configuration loading, a vulnerable release could affect secrets or environment parsing behavior.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
86% confidence
Finding

pydantic-settings has known advisories, but the manifest does not specify an exact version, so the actual exposure cannot be verified. Since this package may load settings and secrets from the environment or filesystem, unverifiable versions create avoidable risk.

Content

No source excerpt is available for this finding.