ClawHub
Back to skill

Security audit

Kubernetes故障手册服务

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a Kubernetes runbook API client, but it stores a user API key locally and contains several unrelated Gaokao/school-search leftovers that make its scope and provenance unclear.

Review before installing. Only use this if you trust the xiaobenyang.com service and are comfortable with your API key being saved in a local .env file and sent to its API. Prefer a disposable or limited-scope API key, check that the working directory will not be committed or backed up with .env included, and treat the Gaokao/school-search leftovers as a sign the package should be cleaned up before broad use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation directs the model to use environment access, local file reads/writes, and network calls, but it declares no permissions or trust boundaries. This creates a transparency and security problem because users and hosting platforms cannot accurately assess that the skill will persist API secrets locally and communicate with remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill claims to be an MCP server for Kubernetes runbooks, but the documented behavior includes collecting an API key from the user, persisting it to a local .env file, mutating runtime configuration, and acting primarily as a remote API client. This mismatch is dangerous because it can mislead users about the trust model, data flows, and the fact that secrets are being stored and transmitted.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The workflow example references an unrelated '高考/学校搜索' function (`search_schools`) inside a skill presented as a Kubernetes runbook service. Cross-domain inconsistency like this is a strong indicator of copy-paste drift or repurposed code, which raises the risk that the model may invoke unintended tools, mishandle user inputs, or interact with unrelated backends and data flows.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documented project structure refers to `xiaobenyang_gaokao_skill`, which is inconsistent with the stated Kubernetes troubleshooting purpose. This identity mismatch undermines trust and suggests the package may be repackaged from another skill, making it harder to verify what code is actually executed and whether secrets or requests are sent to the intended service.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The module includes functions to persist, mutate, and globally expose an API key via .env and process environment state, which is unrelated to the stated Kubernetes troubleshooting handbook purpose. This expands the skill from read-only content access into credential management, increasing the chance of secret leakage, accidental reuse, or abuse if another component can call these helpers.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The Settings docstring describes an unrelated '高考Skill' while the manifest says this is a Kubernetes troubleshooting handbook service, indicating copy-paste residue or mismatched provenance. Context mismatches are suspicious because they can hide repurposed code paths, incorrect environment prefixes, or unintended external integrations that operators may not review carefully.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code writes the supplied API key directly into a local .env file without any user-facing warning, consent flow, or file permission hardening. Persisting secrets this way can leave credentials readable by other local users, accidentally committed to source control, or exposed through backups and logs.

Credential Access

High
Category
Privilege Escalation
Content
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
Confidence
95% confidence
Finding
The code explicitly bypasses the settings framework to force-read .env and extract XBY_APIKEY manually. This unnecessary direct secret parsing increases the attack surface, can defeat expected configuration controls, and is especially suspicious given the skill's unrelated Kubernetes handbook description and mismatched product naming.

Credential Access

High
Category
Privilege Escalation
Content
def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():
Confidence
95% confidence
Finding
Opening and reading the entire .env file to locate an API key exposes all file contents to application logic unnecessarily. If this code is reused, logged, or extended, it increases the risk that unrelated secrets in the same file are mishandled or leaked.

Credential Access

High
Category
Privilege Escalation
Content
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
Confidence
98% confidence
Finding
This function is dedicated to persisting an API key into a .env file, turning a transient secret into a long-lived local artifact. In the context of a handbook-access skill, that capability is unnecessary and increases the likelihood of credential disclosure through local file access, repository mistakes, or operational mishandling.

Credential Access

High
Category
Privilege Escalation
Content
def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()
Confidence
97% confidence
Finding
This API exposes a simple programmatic path to set and persist a secret, which makes credential modification available to any code path that can call it. In a service that should mainly provide read access to troubleshooting content, such secret-management functionality is out of scope and raises the risk of unauthorized credential replacement or persistence.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
97% confidence
Finding
The dependency is specified with a lower-bound version only, which permits installation of different future releases and reduces build reproducibility. In a server that integrates with external systems, this can unexpectedly introduce vulnerable or incompatible versions through normal dependency resolution.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
97% confidence
Finding
Using pydantic with only a minimum version allows unreviewed newer releases to be installed, which weakens supply-chain control and reproducibility. While not directly exploitable by itself, it increases the chance that a future vulnerable or breaking release is pulled into the deployment.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
97% confidence
Finding
An unpinned pydantic-settings dependency means the runtime environment may resolve to different package versions over time. This is a supply-chain hygiene issue that can expose the service to newly introduced vulnerabilities or behavior changes without code changes.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
97% confidence
Finding
python-dotenv is also unpinned, so deployments are not deterministic and may silently consume a future compromised or vulnerable release. For a server process that likely loads configuration from environment files, dependency drift increases operational and security risk.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
94% confidence
Finding
The requirement permits requests 2.31.0, and the static analysis notes multiple advisories affecting that version. In an MCP server that may fetch remote content or interact with external URLs, a vulnerable HTTP client can expose credentials, weaken TLS/session verification behavior, or enable other request-handling abuse depending on how the library is used elsewhere in the skill.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
90% confidence
Finding
The dependency range includes python-dotenv 1.0.1, which is flagged for a symlink-following arbitrary file overwrite issue in set_key. This becomes more relevant if the service or its tooling ever modifies .env files, because an attacker who can influence filesystem links or working paths could potentially overwrite unintended files.

Static analysis

No suspicious patterns detected.