菜谱推荐服务

• Outcome: Pass
• Latest audit: Jul 2, 2026 · 11:22 PM UTC
• Version: 1.0.1

Overview

This recipe skill is a coherent API-backed recipe helper, but users should know it saves the required API key in a local .env file.

Install only if you are comfortable giving this skill a Xiaobenyang API key and having that key saved in a local .env file. Avoid using it from a shared or source-controlled directory unless you protect or exclude .env, and consider rotating the key if the file is exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares itself as a simple recipe service, yet the documented behavior implies access to environment variables, local file read/write, and network operations without any explicit permission declaration or user-facing disclosure. This increases the risk of over-privileged execution and hidden data handling, especially because the skill also collects and persists credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as an MCP recipe recommendation server, but its instructions show it is actually a remote API wrapper that reads and writes API keys locally and manages credentials through env/files. This mismatch can mislead users and reviewers about what code executes and what data is collected, which undermines informed consent and security review.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The workflow example references an unrelated function `search_schools(...)` instead of the declared recipe tools, showing copy-paste inconsistency in agent instructions. Such instruction drift is dangerous because it can cause the model to call unintended tools, mishandle user data, or reveal that the skill documentation is unreliable and insufficiently reviewed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to ask the user for an API key and then persist it via `set_api_key(api_key)` without warning the user that the credential will be stored locally, likely in `.env`. Storing secrets without clear consent or retention disclosure creates avoidable credential exposure risk if local files are read, leaked, or reused unexpectedly.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The function silently writes the API key to a local .env file in plaintext and sets it in process environment without any explicit user-facing warning or confirmation. On shared systems, in checked-in working directories, or in deployments with weak file permissions, this can expose credentials to other users, backups, or source control.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 86% confidence
• Finding: This function implements plaintext persistence of an API key into a local .env file, which creates a durable secret exposure surface on disk. In the context of a recipe recommendation skill, secret storage is plausible for backend access, but persisting it this way without stronger safeguards is unnecessarily risky and could lead to credential disclosure through file sharing, repository commits, or local compromise.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 83% confidence
• Finding: The setter is explicitly designed to persist the provided API key to disk through the .env-writing helper, extending the lifetime and exposure of the secret beyond the current session. That persistence increases risk of accidental disclosure even though the apparent intent is configuration convenience rather than abuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The dependency specifier `requests>=2.31.0` is unpinned, so future installs may resolve to different versions over time, reducing build reproducibility and making it harder to control when security-relevant changes enter the environment. In this file, the risk is amplified because the minimum allowed version includes a release with known advisories, and there is no upper bound or exact pin to constrain exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 93% confidence
• Finding: `pydantic>=2.7.0` is an unpinned dependency, which permits uncontrolled version drift across environments and deployments. While unpinned dependencies are typically a supply-chain hygiene issue rather than an immediately exploitable bug, they can introduce breaking changes or newly vulnerable transitive resolutions without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 93% confidence
• Finding: `pydantic-settings>=2.2.0` is unpinned, which weakens reproducibility and dependency integrity controls. This does not indicate malicious behavior, but it increases operational and supply-chain risk because builds may silently pick up different package versions over time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: `python-dotenv>=1.0.1` is unpinned and allows installation of varying versions, making builds non-deterministic and complicating security review. In this case the minimum allowed version is also associated with a published advisory, so leaving it open-ended without an explicit safe floor or exact pin increases the chance of deploying an exposed version.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The requirement permits `requests` 2.31.0, which is associated with multiple advisories including credential leakage via `.netrc`, request verification issues in `Session`, and insecure temporary file handling in a utility path. In an AI recipe recommendation service, outbound HTTP usage is plausible for API calls or content retrieval, so a vulnerable `requests` version could expose secrets or weaken transport/security assumptions if the application uses affected code paths.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: The requirement permits `python-dotenv` 1.0.1, which is reported as vulnerable to symlink following in `set_key`, potentially enabling arbitrary file overwrite if an attacker can influence target paths or the filesystem layout. This recipe service likely handles configuration and environment files, so if management tooling or runtime code uses the affected helper in writable directories, the issue could be abused to alter sensitive files.

Static analysis

No suspicious patterns detected.