JSON-RPC服务

• Outcome: Review
• Latest audit: Jul 2, 2026 · 11:24 PM UTC
• Version: 1.0.1

Overview

This skill appears to be a JSON-RPC tool, but it actually routes calls through a third-party API while collecting and storing an API key locally.

Install only if you are comfortable giving this skill a xiaobenyang API key, storing it in a local .env file, and having JSON-RPC server URLs, methods, and parameters sent through the xiaobenyang API. Avoid using it with internal/private URLs or sensitive request parameters unless the publisher clarifies the data flow and credential storage model.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation indicates capabilities to read environment variables, read/write local files, and perform network access, yet no explicit permissions are declared. This weakens user and platform visibility into sensitive operations, especially because the workflow includes reading credentials and persisting an API key to local configuration. In a skill that can contact arbitrary servers, undeclared capabilities materially increase risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose says this is a JSON-RPC/OpenRPC service, but the workflow and project structure describe a different capability: collecting an API key for an external site, reading/writing local configuration, and wrapping another API. This mismatch can mislead users into granting secrets or network access under false expectations, which is especially dangerous because the skill also enables outbound requests and credential persistence.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill requires an API key from an unrelated external site for a purported JSON-RPC utility, which is a strong supply-chain and trust-boundary concern. Users may be induced to disclose credentials without a clear, relevant reason, and the dependency is not contextualized as necessary for generic JSON-RPC discovery/calls.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The workflow and project structure reference a gaokao/xiaobenyang API skill rather than the declared JSON-RPC service, indicating copy-paste drift or repurposed documentation. Such inconsistencies are dangerous because they obscure the real execution path, make security review unreliable, and can hide secret handling or unexpected external communications from users.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This configuration module contains business-specific remote service configuration and API key management that do not align with the stated purpose of a generic JSON-RPC/MCP server. The mismatch increases supply-chain and trust risk because the skill can silently bind itself to an unrelated external service and manage credentials for it.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code can persist and modify API credentials locally by writing to .env and updating process environment state. In a skill advertised as a JSON-RPC/MCP service, that capability exceeds least-privilege expectations and can create unauthorized secret retention or credential replacement risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the model to ask the user for an API key and then store it via configuration without warning that the secret will be persisted locally. Collecting and persisting credentials without transparent notice increases the chance of accidental disclosure, unsafe reuse, or retention beyond user expectations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill supports arbitrary JSON-RPC calls to user-supplied server URLs but provides no warning about sending data to third-party endpoints. This creates SSRF-like and data-exfiltration risks in practice, especially if users provide internal URLs or sensitive parameters that the tool forwards over the network.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The function stores an API key into .env without any user-facing warning, confirmation, or file-permission checks. Silent persistence of secrets increases the chance of accidental exposure through local files, backups, source control, shared workspaces, or later reuse by unrelated processes.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 84% confidence
• Finding: This function explicitly saves an API key to a local .env file, creating durable credential storage on disk. Persistent plaintext secret storage increases exposure risk from local compromise, backups, accidental repository inclusion, and multi-user environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The dependency uses a lower-bound version specifier instead of an exact pinned version, which makes builds non-reproducible and can cause the environment to resolve to newer package versions with unreviewed behavior or newly introduced vulnerabilities. In an MCP/JSON-RPC server, dependency stability matters because network-facing components may be exposed to untrusted input and runtime drift can silently change security properties.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The dependency is not pinned to an exact version, so installations may resolve differently over time and pull in unreviewed releases. For a service component, this increases supply-chain and operational risk because behavior and security posture can change without code changes in the project itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: Using an open-ended version range allows future releases of pydantic-settings to be installed automatically, reducing build reproducibility and increasing supply-chain risk. This is especially relevant in a server-side skill where configuration parsing can affect runtime behavior and security-sensitive settings.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The package is specified with a minimum version only, so future installs can pull different releases, including ones with incompatible changes or new security issues. Since dotenv libraries can influence configuration loading, uncontrolled version drift can affect how secrets and environment settings are handled.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The dependency range permits requests 2.31.0, and that version is associated with published advisories including credential leakage and session verification issues. In a JSON-RPC/MCP server that likely performs outbound HTTP requests, these flaws can matter because attacker-controlled URLs or repeated session use could expose credentials or weaken transport security.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The dependency range permits python-dotenv 1.0.1, which has an advisory involving symlink following during set_key that can enable arbitrary file overwrite in certain usage patterns. This becomes relevant if the service or its administrative tooling writes .env files in attacker-influenced locations or with unsafe filesystem permissions.

Static analysis

No suspicious patterns detected.