热点聚合服务

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a hot-trends API wrapper, but it handles API credentials in ways that could expose them and includes broader fetching capabilities that need review.

Review this skill before installing. Use it only in a trusted workspace, verify that XBY_GAOKAO_BASE_URL is not set to an unexpected host, avoid committing or sharing the generated .env file, and rotate the XiaoBenYang API key if the workspace may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/call_api.py:51

Finding

Configurable API Endpoint Can Expose the API Key to an Attacker-Controlled Server

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:39

Finding

API Key Is Persisted in Plaintext Without Explicit Restrictive File Permissions

Content

View full analysis

bool: """Persist the API key in the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return False def set_api_key(api_key: str) -> bool: """Set the API key and persist it in .env.""" if not api_key or not api_key.strip(): return False api_key = api_key.strip() if not save_api_key_to_env(api_key): return False ``` ### Technical Analysis The Skill stores the API key directly in a plaintext `.env` file located in the current working directory. `Path.write_text()` creates files according to the process umask and does not explicitly enforce owner-only permissions. If `.env` already exists with permissive permissions, rewriting it does not correct those permissions. Keeping the secret in the project working directory also increases the probability of accidental disclosure through source-control commits, workspace archives, backups, diagnostic bundles, or access by unrelated processes. The key is additionally copied into the process environment, where it may be accessible to sufficiently privileged local inspection tools or ...[truncated 1289 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The stated purpose is hotspot aggregation, but the skill also exposes generic website crawling and custom RSS ingestion, which are materially broader network capabilities than curated trend retrieval. That expansion increases SSRF-like, data exfiltration, and unreviewed content-fetch risks while remaining under-disclosed in the top-level description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The stated purpose is hotspot aggregation, but the skill also exposes generic website crawling and custom RSS ingestion, which are materially broader network capabilities than curated trend retrieval. That expansion increases SSRF-like, data exfiltration, and unreviewed content-fetch risks while remaining under-disclosed in the top-level description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The code explicitly opens and parses .env to extract XBY_APIKEY, bypassing normal settings abstractions and directly handling credentials. Manual secret scraping increases the chance of unintended exposure and indicates the skill is actively processing sensitive material beyond simple configuration loading.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The existence check is part of a manual secret access flow that reads credential material from disk. In the context of a hotspot aggregation service, directly traversing secret files is unnecessary and expands the attack surface for credential disclosure through coding mistakes or future feature creep.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This function persists an API key into .env on disk, creating durable storage of sensitive credentials inside the skill's working directory. If the filesystem is shared, backed up, logged, or accidentally committed, the key can be exposed and abused to access upstream services.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents capabilities that imply environment access, file read/write, and network use, but it does not declare an explicit tool scope or permissions boundary. In an MCP/agent setting, missing scope declarations weaken least-privilege guarantees and can cause users or hosts to underestimate what the skill can access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The entire skill documentation is written as mandatory Chinese-language operating instructions, and many tool descriptions explicitly frame outputs as Chinese content, but there is no statement allowing the user to choose language or clarifying that the skill is intentionally region-specific. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A skill framed as a news/trend aggregator includes a general website crawler, which broadens it from fixed-source retrieval to arbitrary network access. In agent environments this can be abused to fetch internal resources, unexpected external content, or sensitive pages if the runtime has network reachability beyond intended public sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The website crawling feature lacks a clear user-facing warning that it will perform external network requests and retrieve arbitrary page content. Without explicit notice and boundaries, users may unknowingly authorize requests to sensitive destinations or process untrusted content with greater risk than expected.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Referencing an unrelated gaokao project structure inside a hot-trend aggregation skill suggests copy-paste drift or packaging confusion, which undermines trust in the reviewed artifact and may hide unexpected code paths or configuration behavior. In security review, such inconsistencies increase the chance that the deployed implementation does more than the documented purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code performs an outbound HTTP POST using caller-supplied params and includes an API key in headers, which can transmit user or system data to an external service. While the code logs success and errors, those logs are not user-facing warnings or disclosures about the network transmission itself, and this file contains no prompt, comment, or docstring warning about that behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Settings 类的文档字符串写的是“"小笨羊高考Skill配置"”，而当前技能清单名称和描述均指向“热点聚合服务”。这不是单纯信息缺失，而是对技能用途的直接错配，可能误导维护者对该模块真实服务对象和配置语义的理解。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module does more than read configuration: it persists an API key to a local .env file and mirrors it into process environment state. Persisting secrets to disk increases exposure through accidental source inclusion, weak filesystem permissions, logs, backups, or multi-tenant runtime access, and this behavior is broader than expected for a news/hotspot aggregation skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is described as a热点/趋势聚合服务, but it also exposes a generic website crawling primitive via crawl_website(url). That broadens capability from curated aggregation to arbitrary external fetches, which can enable misuse such as fetching attacker-chosen targets, internal resources, or content outside the declared trust boundary if the backend does not enforce strict URL restrictions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

An arbitrary URL fetch/crawl function is not clearly necessary for a news/trending aggregation skill and increases attack surface beyond the advertised use case. In agent environments, such generic network access can be abused for SSRF-style probing, unintended data retrieval, or access to sensitive metadata/internal endpoints depending on how call_api is implemented downstream.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The wrapper exposes website crawling with no user-facing warning that the skill may contact arbitrary third-party sites based on provided URLs. This reduces transparency and increases the chance of users or orchestrators invoking network access they did not expect, especially when the skill otherwise appears to only query fixed trend sources.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The workflow section states that the model routes requests and that '代码只负责调用API', implying a bounded API-wrapper design. But the listed tools include crawl_website, which semantically differs from simply calling the service's aggregation API and expands behavior into direct site retrieval/crawling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specifier uses a lower bound only, which makes builds non-reproducible and allows future package releases to be pulled in without review. This increases supply-chain risk and makes it impossible to verify whether a deployed version includes known security fixes or newly introduced vulnerabilities.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin requests, so there is no reliable way to determine whether the installed version is affected by known advisories such as credential leakage issues. In a hotspot aggregation service that likely makes external HTTP requests, this uncertainty is more relevant because network-facing code may exercise vulnerable request-handling paths.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using pydantic with only a minimum version permits installation of any later release, which weakens reproducibility and can unexpectedly introduce vulnerable or incompatible versions. In a service-oriented skill, this creates avoidable supply-chain uncertainty even if no immediate exploit is shown in this file.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

Because pydantic is not pinned, the deployed version may fall on either side of known security fixes, including denial-of-service related issues. The file alone does not prove exploitation, but the unverifiable version state is a real supply-chain weakness that prevents accurate risk assessment.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The unpinned pydantic-settings dependency allows uncontrolled upgrades at install time, which can pull in versions with security defects or behavior changes. This is a classic dependency hygiene issue that becomes more relevant for configuration-handling libraries because they may process secrets and local file paths.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

The version of pydantic-settings is not fixed, so it cannot be verified whether installations are exposed to known issues affecting secret and path handling. Given this library's role in application configuration, uncertainty around vulnerable versions can have security consequences if unsafe code paths are later used.

Content

No source excerpt is available for this finding.