AntV文档协议服务

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.0.1

Overview

This skill may be useful for AntV documentation lookup, but it sends full user queries and an API key to a third-party service while persisting the key locally and showing signs of copied or mismatched project content.

Review before installing. Use this only if you are comfortable sending AntV-related prompts, code snippets, errors, and derived task data to the XiaoBenYang MCP service. Do not provide secrets or proprietary code in queries unless approved, avoid storing the API key in a shared or committed workspace, and prefer a scoped environment secret over the skill's plaintext .env persistence.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tools.py:38

Finding

Mandatory transmission of complete user queries to a third-party service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-35, 46-72, 147-149; scripts/tools.py:38-45, 80-86; scripts/call_api.py:65-78
Vulnerability Type: Sensitive-data disclosure through mandatory remote processing
Risk Level: Medium

Vulnerable Code

python

arguments = {
    "query": query,
    "library": library,
    "maxTopics": maxTopics
}

return call_api("1777316659406851", "extract_antv_topic", arguments)

python

arguments = {
    "library": library,
    "query": query,
    "topic": topic,
    "intent": intent,
    "tokens": tokens,
    "subTasks": subTasks
}

return call_api("1777316659406851", "query_antv_document", arguments)

python

resp = self._session.post(
    url=url,
    headers=headers,
    data=json.dumps(params),
    timeout=settings.timeout_seconds,
)

Technical Analysis

The Skill instructions require remote preprocessing and document retrieval for every AntV-related request, including simple questions. The implementation serializes the complete query together with library information, extracted topics, intent, subtasks, and token settings and sends them to mcp.xiaobenyang.com.

Full user queries can contain proprietary source code, credentials, internal paths, error logs, customer data, or confidential project requirements. The implementation does not perform secret detection, field-level redaction, data minimization, or confirmation before transmission.

Remote document retrieval is consistent with the Skill's general functionality, but mandatory transmission of the complete query exceeds the minimum data access necessary in cases where sanitized keywords or local routing would suffice. The reviewed files also do not establish that the recipient is operated by AntV, despite the Skill describing retrieval from official AntV resources.

Attack Path

1. A user submits an AntV debugging or implementation request containi ...[truncated 903 chars]

Remediation

View remediation

Remediation Suggestions

1. Clearly disclose the remote hostname, service operator, transmitted fields, and relevant data-handling policy before use.
2. Obtain explicit user consent before transmitting prompt content to a third party.
3. Remove the requirement that every AntV request must invoke both remote operations.
4. Send only minimal search keywords or sanitized technical topics rather than the complete query.
5. Add secret and sensitive-data detection for API keys, access tokens, private keys, credentials, personal data, internal URLs, and proprietary source fragments.
6. Provide a preview of outbound data and allow the user to redact or decline transmission.
7. Provide a local or offline path for simple routing, library identification, and requests that do not require remote retrieval.
8. Document retention, logging, and deletion behavior for the remote service.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:9

Finding

Configurable API endpoint can receive credentials and user data without destination validation

Content

View full analysis

Vulnerability Details

File Location: scripts/config.py:9-18; scripts/call_api.py:53-78
Vulnerability Type: Unvalidated configurable trust boundary
Risk Level: Medium

Vulnerable Code

python

model_config = SettingsConfigDict(
    env_prefix="XBY_GAOKAO_",
    env_file=".env",
    env_file_encoding="utf-8",
    extra="ignore",
)

# API configuration
base_url: str = "https://mcp.xiaobenyang.com"
mcp_id: str = "1820705335657482"
api_key: str = ""

python

url = f"{settings.base_url}/api"
mcp_id = mcp_id or settings.mcp_id

api_key = get_api_key()
if not api_key:
    raise UpstreamError("API key is not configured")

headers = {
    "XBY-APIKEY": api_key,
    "func": tool_name,
    "mcpid": mcp_id,
    "Content-Type": "application/json",
}

resp = self._session.post(
    url=url,
    headers=headers,
    data=json.dumps(params),
    timeout=settings.timeout_seconds,
)

Technical Analysis

base_url is a Pydantic setting with the XBY_GAOKAO_ environment prefix. It can therefore be overridden through configuration, including XBY_GAOKAO_BASE_URL. The client unconditionally attaches the API key and complete request parameters to the resulting URL.

No validation restricts the scheme to HTTPS, verifies that the hostname is trusted, or prevents credentials from being sent to an unexpected destination. Although the default endpoint uses HTTPS, an attacker or deployment error that controls environment variables or the .env settings can change the trust boundary.

Requests normally validates TLS certificates for HTTPS endpoints, which protects the default destination from ordinary interception. That protection does not address deliberate endpoint replacement through configuration.

Attack Path

1. An attacker gains the ability to influence process environment variables, deployment settings, or the applicable .env file.
2. The attacker sets ` ...[truncated 841 chars]

Remediation

View remediation

Remediation Suggestions

1. Keep the production endpoint fixed in code unless endpoint customization is an explicit requirement.
2. If customization is necessary, parse the URL and require the https scheme.
3. Enforce an allowlist of approved hostnames, such as the exact expected API hostname.
4. Reject URLs containing user information, fragments, unexpected ports, or non-empty paths that could alter routing.
5. Do not attach credentials after redirects to a different origin; disable redirects or validate every redirect target.
6. Separate test credentials from production credentials and require explicit test-mode configuration for alternate endpoints.
7. Fail closed and display a clear error when destination validation fails.
8. Add automated tests covering HTTP URLs, look-alike domains, subdomain confusion, malformed URLs, and redirect behavior.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:44

Finding

API key is persisted in plaintext without explicit file-permission hardening

Content

View full analysis

Vulnerability Details

File Location: scripts/config.py:44-65; SKILL.md:18-20, 27-30
Vulnerability Type: Insecure credential storage
Risk Level: Medium

Vulnerable Code

python

def save_api_key_to_env(api_key: str) -> bool:
    """Save the API key to the .env file."""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
        found = False
        new_lines = []
        for line in lines:
            if line.startswith("XBY_APIKEY="):
                new_lines.append(f"XBY_APIKEY={api_key}")
                found = True
            else:
                new_lines.append(line)
        if not found:
            new_lines.append(f"XBY_APIKEY={api_key}")
        env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8")
        os.environ["XBY_APIKEY"] = api_key
        return True
    except Exception as e:
        print(f"Failed to save API key: {e}")
        return False

Technical Analysis

The Skill instructs the agent to request the API key and persist it through set_api_key. The implementation writes the credential in plaintext to .env in the current working directory.

Path.write_text does not explicitly create the file with owner-only permissions, and the code does not inspect or correct permissions on an existing file. Actual accessibility depends on the process umask and filesystem configuration. The package also does not include a .gitignore rule preventing accidental source-control inclusion.

Storing the credential is useful for repeated operation, but persistent plaintext storage is not the minimum privilege necessary: the key could remain process-local, be supplied through a protected environment variable, or be stored in an operating-system secret manager.

Attack Path

1. The user supplies an API key when prompted.

...[truncated 765 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an operating-system credential manager, container secret, orchestrator secret, or environment-only configuration.
2. Do not persist the key by default; obtain explicit consent if persistence is offered.
3. If a file is required, create it atomically with owner-only mode 0600.
4. Validate existing .env ownership and permissions before reading or updating it, and reject unsafe files.
5. Resolve the storage path explicitly rather than depending on the current working directory.
6. Add .env to .gitignore and document that it must never be committed or included in artifacts.
7. Avoid copying the secret into unnecessary global process state.
8. Provide credential rotation and deletion instructions in case of exposure.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependencies are not upper-bounded or integrity-pinned

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: Non-reproducible dependency resolution
Risk Level: Low

Vulnerable Code

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Technical Analysis

Every dependency uses only a minimum version. Installation can therefore select arbitrary future versions, including releases that were not reviewed with this Skill. No lock file or package hashes are supplied to verify the exact artifacts installed.

The listed packages use expected public package names, and the reviewed project provides no evidence of typosquatting, dependency confusion, or an intentionally malicious package. The finding is limited to supply-chain hardening and reproducibility.

Attack Path

1. The Skill is installed at a later date or in a different environment.
2. The package resolver selects a newer dependency version because no upper bound or exact lock exists.
3. A compromised, malicious, or incompatible future package artifact is downloaded.
4. Its installation-time or import-time behavior executes within the Skill's Python environment.
5. It receives the privileges of the process running the Skill, subject to the host's environment and sandbox controls.

Impact Assessment

A compromised dependency could potentially access the process environment, API credential, local files available to the Skill, and network connectivity. No such compromise is present in the reviewed code, so this is a preventive supply-chain risk rather than evidence of current malicious execution.

Remediation

View remediation

Remediation Suggestions

1. Generate a reviewed lock file containing exact transitive dependency versions.
2. Use hash verification, such as pip requirements with --hash entries and --require-hashes.
3. Apply compatible upper bounds when exact pins are not operationally suitable.
4. Install only from approved package indexes over authenticated TLS.
5. Use automated vulnerability and dependency-update scanning.
6. Review release notes and test updates before regenerating the lock file.
7. Build and retain a software bill of materials for deployed versions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (28)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This second mismatch is particularly concerning because it explicitly describes reading and writing a local .env, mutating os.environ, and configuring a remote service branded for a different domain ('小笨羊高考'). In the context of a documentation helper, hidden secret handling and persistent local writes are materially more dangerous than the declared use case suggests, raising the risk of credential misuse, configuration poisoning, and user deception.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This second mismatch is particularly concerning because it explicitly describes reading and writing a local .env, mutating os.environ, and configuring a remote service branded for a different domain ('小笨羊高考'). In the context of a documentation helper, hidden secret handling and persistent local writes are materially more dangerous than the declared use case suggests, raising the risk of credential misuse, configuration poisoning, and user deception.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The model_post_init method explicitly opens and reads .env to extract XBY_APIKEY, creating direct credential-access behavior beyond normal configuration loading. In the context of a documentation service, this is more concerning because secret handling is outside the expected scope and increases the chance of unintended exposure or misuse.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This line participates in custom parsing of a local .env file for an API key, which is a form of credential access not clearly justified by the skill's stated purpose. Such custom secret-reading logic is easy to misuse, hard to audit, and may bypass expected host controls around secret injection.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This function initiates writing API credentials to a local .env file, creating plaintext at-rest secret storage in application-controlled code. If the workspace is shared, backed up, committed, or otherwise accessible, the credential can be exposed and then used to access upstream services.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill declares no explicit tool scope or permission boundaries while its documented behavior implies access to environment variables, local file read/write, and outbound network calls. In an agent setting, this increases the blast radius: the model may be induced to read secrets, persist attacker-controlled values, or exfiltrate data through remote API calls without clear least-privilege constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill content is predominantly written in Chinese and presents its requirements and workflow as mandatory, but it does not offer the user a choice of language or state that Chinese is optional. This can violate a language/locale policy when users have not explicitly opted into Chinese-language interaction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Unrelated '高考/学校查询' workflow content inside an AntV documentation skill is a strong indicator of copy-paste contamination or repurposed instructions. In a security review context, such inconsistencies reduce trust in the skill's stated behavior and can hide unexpected tool calls, data routing, or prompts that steer the agent toward unrelated external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code sends params to an external API and includes an API key in request headers, which is a safety-relevant network operation. While the module logs success and error events, there is no user-facing warning, confirmation, or explanatory comment/docstring disclosing that user-provided data and credentials will be transmitted off-system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This module includes functionality to persist API credentials into a local .env file, which is unrelated to the stated purpose of serving AntV documentation context and examples. Storing secrets on disk increases the risk of accidental disclosure through source control, backups, shared workspaces, or other local file access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill can mutate and store credentials via set_api_key/save_api_key_to_env even though its declared role does not require credential management. This expands the skill's capability beyond documentation serving and creates an unnecessary secret-handling surface that could be abused or mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code persists an API key to .env without any user-facing warning, consent flow, or disclosure that credentials will be written to disk. Silent persistence can cause users to unknowingly leave secrets behind in insecure locations, especially in shared development environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The documentation asserts an active capability to scan installed libraries and detect dependencies, yet within this skill file there is no corresponding implementation detail or supporting code path—only parameter descriptions for tool calls. This creates an intent/documentation divergence by promising behavior not evidenced by the described tool interface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The project structure naming an unrelated 'gaokao' skill conflicts with the advertised AntV service and reinforces that the package may be misrepresented or assembled from another project. While this alone is less severe than active secret handling, it increases the chance that hidden code paths, endpoints, or stored secrets serve an unintended purpose.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a lower-bound specifier instead of an exact pinned version, which makes builds non-reproducible and can cause unexpected installation of newer releases with security or compatibility regressions. In a server-side skill that provides documentation/context services, this increases supply-chain risk because deployment behavior may vary over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using an unpinned pydantic version allows future installs to resolve to different releases, reducing reproducibility and making it harder to verify whether a deployed version contains known flaws. For a service component, this is a real but low-severity supply-chain hygiene issue rather than an immediate exploit by itself.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The pydantic-settings package is specified with a minimum version only, so dependency resolution may pull in newer versions unpredictably. This weakens software supply-chain control and complicates assurance that the runtime is free from known vulnerable releases.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

python-dotenv is unpinned, which permits non-deterministic dependency resolution and may introduce vulnerable or incompatible versions into deployments over time. In configuration-loading components, this matters because security-sensitive file handling behavior can change between releases.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.