代码文档更新服务

• Outcome: Pass
• Latest audit: Jul 3, 2026 · 12:21 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed API-backed documentation helper, but users should understand it stores a XiaoBenYang API key in a local plaintext .env file.

Install only if you are comfortable using the XiaoBenYang backend for Context7-style documentation requests. The API key and query parameters are sent to that service, and the key is stored in a local .env file as XBY_APIKEY, so keep that file private, gitignored, and avoid using this in shared workspaces unless you manage the secret separately.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill exercises sensitive capabilities including environment access, local file reads/writes, and network use, yet declares no permissions or trust boundary information. This creates a transparency and consent failure: users and hosting platforms cannot accurately assess that the skill will read and persist API keys locally and contact an external backend before enabling it.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest says the skill provides Context7 documentation, but the behavior described includes reading, storing, and mutating API-key state and routing requests through a XiaoBenYang backend rather than clearly documented direct Context7 access. This mismatch is dangerous because it can mislead users into disclosing secrets under false assumptions about where credentials go and what the skill actually does.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The workflow and project structure reference unrelated tools and a different domain, indicating the skill may be repurposed from another project without proper review. Such copy-paste inconsistencies increase the chance that the agent invokes unintended functions, mishandles parameters, or sends user data and secrets to the wrong backend.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module does more than passive configuration: it persists API keys to a local .env file and mutates process environment state, which is more sensitive behavior than the skill description suggests. This mismatch reduces transparency for users and reviewers, increasing the risk of unintended secret storage on developer machines.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The configuration declares an env_prefix of XBY_GAOKAO_ but the code bypasses that scheme and directly reads XBY_APIKEY from .env and the environment. This inconsistency can cause operators to misconfigure secrets, unintentionally load the wrong credential source, and weaken auditability of how secrets are resolved.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function writes the API key in plaintext to .env without any runtime warning, confirmation, or security controls. On shared systems or in projects where .env files are accidentally committed, this can expose credentials and enable unauthorized API use.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 89% confidence
• Finding: The code manually parses .env to extract XBY_APIKEY, bypassing the settings library's normal secret handling and validation flow. Manual secret-file parsing increases the chance of inconsistent precedence, accidental exposure, and hidden credential behavior that reviewers may miss.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 94% confidence
• Finding: This function persists the API key to a plaintext .env file in the project directory, creating a durable local secret that may be read by other users, tooling, backups, or accidentally committed to source control. In a developer-tool skill, this is especially risky because users may run it inside repositories and shared workspaces.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 90% confidence
• Finding: The function is explicitly designed to persist credentials to .env, normalizing long-term storage of secrets without visible safeguards. This expands the attack surface because any later local compromise, repository leak, or workspace sharing can expose the API key.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: The dependency uses a lower-bound specifier (`requests>=2.31.0`) instead of pinning to a specific version or constrained range, which harms build reproducibility and can unintentionally pull in insecure or breaking releases. In a security-sensitive agent skill that fetches code documentation over the network, dependency drift increases supply-chain risk and makes vulnerability management harder.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: `pydantic>=2.7.0` is unpinned, so installs may vary over time and across environments. This creates supply-chain and stability risk because future versions could introduce vulnerabilities, incompatible behavior, or malicious compromise in the dependency chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: `pydantic-settings>=2.2.0` is not pinned, which weakens reproducibility and may allow unreviewed versions into production. For an agent-integrated service, configuration-parsing dependencies are part of the trusted base, so uncontrolled upgrades expand supply-chain exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: `python-dotenv>=1.0.1` is unpinned, allowing environment-dependent installs and reducing assurance that deployments use the same reviewed package version. Since this library handles environment configuration, dependency drift can affect secret handling behavior and introduce avoidable supply-chain risk.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The requirement permits `requests` 2.31.0, which is flagged with multiple advisories, including credential leakage via malicious URLs and session verification issues. Because this skill is a documentation-update/network-facing service, use of a vulnerable HTTP client is more relevant: it may process attacker-influenced URLs or remote content, increasing the chance of credential exposure or weakened TLS/request validation behavior.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The requirement permits `python-dotenv` 1.0.1, which is reported as vulnerable to symlink-following during `set_key`, enabling arbitrary file overwrite in affected usage patterns. This is only exploitable if the skill actually invokes the vulnerable write path on attacker-influenced filesystem locations, so the dependency issue is real but likely lower impact absent evidence of that usage.

Static analysis

No suspicious patterns detected.