Kubernetes故障手册服务

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.1

Overview

This skill appears to fetch Kubernetes runbooks through an external API, but its mismatched Gaokao/XBY code and plaintext API-key handling need review before installation.

Review this before installing. Only use a low-scope Xiaobenyang API key, do not run it in a repository where .env may be committed or shared, verify the API endpoint is the intended HTTPS host, and prefer a version that removes the Gaokao/XBY mismatch, avoids plaintext credential persistence, validates outbound destinations, and pins dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/config.py:10

Finding

API Credential and User Query Data Can Be Redirected to an Arbitrary Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:42

Finding

API Key Is Persisted in a Plaintext File Without Restrictive Permission Controls

Content

View full analysis

bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False def set_api_key(api_key: str) -> bool: """设置API key并持久化到.env""" if not api_key or not api_key.strip(): return False api_key = api_key.strip() if not save_api_key_to_env(api_key): return False # 更新全局 settings 实例 settings.api_key = api_key return True ``` ### Technical Analysis The Skill stores the complete API credential as a plaintext `XBY_APIKEY` entry in `.env`. It uses `Path.write_text()` without explicitly creating the file with owner-only permissions, checking the ownership or type of an existing path, or using a protected credential store. The code also rewrites an existing `.env` file directly rather than using an atomic, permission-controlled replacement. There is no project `.gitignore` in the audited directory to reduce the risk of accidental source-control inclusion. The Skill instructions require persistence after collecting the key, even though persistent storage is not inherently necessary to perform a single API request ...[truncated 967 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Open-Ended Dependency Constraints Make Builds Non-Reproducible

Content

View full analysis

=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1 ``` ### Technical Analysis Every dependency uses a lower-bound-only version constraint. Installation can therefore resolve to any future release satisfying the minimum version, including versions that were not reviewed when the Skill was audited. The dependency declaration also lacks package hashes or a lock file for integrity and reproducibility. The package names shown are established packages, and the audit did not find direct evidence that the currently named dependencies are malicious. The risk arises from uncontrolled future resolution, dependency compromise, incompatible releases, or changes in transitive dependencies. ### Attack Path 1. A future direct or transitive dependency release is compromised or introduces a security vulnerability. 2. A user installs the Skill after that release becomes available. 3. The package resolver selects the new release because the `>=` constraint permits it. 4. Unreviewed package code executes during installation, import, or runtime. 5. The compromised dependency gains the privileges of the process running the Skill, including possible access to the plaintext API key and outbound network capability. ### Impact Assessment A compromised dependency executes with the same local privileges as the Skill process. Depending on the runtime environment, this could permit reading project files and environment variables, accessing the stored API key, modifying user-accessible files, and making network requests. No actual compromised package or currently exploitable dependency version was established from the audited files. This finding concerns supply-chain hardening and non-reproducible resolution. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is Kubernetes runbook access, but the described behavior includes local .env persistence, API-key management, and references to an unrelated Gaokao/XBY service. This mismatch is dangerous because users and reviewers may grant trust and permissions based on the stated purpose while the skill handles secrets and potentially communicates with an unrelated external service.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This code forcibly reads XBY_APIKEY from .env during initialization, explicitly harvesting a credential from local storage for an unrelated external service. In the context of a purported Kubernetes handbook skill, this unexplained secret collection is more dangerous because it violates expected scope and can enable unauthorized outbound service use.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The explicit opening and parsing of .env is part of the secret-collection path and contributes to plaintext credential exposure. Manual parsing bypasses safer abstractions, increases the chance of mishandling, and normalizes reading local secrets for a service whose purpose does not match the advertised skill.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This function persists API keys to .env, creating a durable plaintext secret store and modifying process environment state. Because the skill claims to provide Kubernetes troubleshooting handbook access, secret persistence for an unrelated external service is especially risky: users may unknowingly entrust credentials to code outside the advertised scope, and those credentials may later be exfiltrated from disk or source control.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises access to multiple sensitive capabilities (environment access, file read/write, and network) but does not declare any tool scope or allowed-tools restrictions. In an agent setting, this weakens least-privilege boundaries and makes it easier for the skill to access or persist sensitive data, especially because the document explicitly instructs saving an API key to local configuration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill claims to provide runbook access but requires collection and persistence of a third-party API key, which is not obviously necessary for static or public runbook retrieval. In this context, requesting secrets under an unrelated banner increases phishing and secret-exfiltration risk, especially since the key is to be saved locally for reuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow section includes an example call to search_schools(...), which is unrelated to Kubernetes runbooks and indicates copy-pasted or repurposed instructions. Such inconsistencies increase the risk of accidental invocation of unintended tools, misrouting of user data, or concealment of the skill's real behavior from reviewers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code sends the caller-provided params payload to a remote endpoint via POST, which may include user or system data. There is logging for success and failure, but no confirmation prompt, print, or explicit user-facing disclosure that data will be transmitted off-system.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The class docstring says "小笨羊高考Skill配置", which describes a completely different skill domain from the manifest's Kubernetes troubleshooting handbook service. This is an active contradiction in code documentation rather than a mere omission, indicating the file may have been repurposed without aligning documented intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This skill, described as a Kubernetes troubleshooting handbook service, is configured to use credentials for an unrelated external XBY service. That scope mismatch is dangerous because it may cause users or operators to provide secrets to an unexpected third party, creating a covert data-flow and trust-boundary violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline comment and code explicitly refer to reading XBY_APIKEY, while the manifest describes a Kubernetes MCP server. This documentation and naming indicate a different product/integration intent than the stated skill, creating a clear intent-code mismatch in the file's documented purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code persists API keys into a local .env file, which creates durable plaintext secret storage on disk. In many deployments, .env files are readable by other local users, accidentally committed to source control, included in backups, or exposed through misconfiguration, making credential theft more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Saving an API key to .env without clear disclosure is dangerous because users may believe the key is only used in memory while it is actually written to disk. Undisclosed persistence increases the chance of accidental leakage through repository commits, logs, workstation compromise, or shared environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill name, description, and operating instructions are presented entirely in Chinese, including imperative workflow requirements to the model. There is no indication that users may choose another language or that the locale restriction is justified as region-specific, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification uses a lower bound (requests>=2.31.0) rather than pinning an exact version, which makes builds non-reproducible and can allow installation of unexpectedly vulnerable or behavior-changing releases. In a server component that integrates with AI and Kubernetes troubleshooting workflows, this weakens supply-chain assurance even though the manifest itself is not directly exploitable code.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest includes requests without an exact version pin, and the package has multiple known advisories across its release history. Because the installed version is not fixed, it is not possible to verify from this file alone whether deployment will use a patched or vulnerable release, creating a real but low-severity supply-chain verification gap.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using pydantic>=2.7.0 leaves the resolved version open-ended, so different environments may install different releases, including versions with newly introduced flaws or breaking changes. This is a supply-chain hardening issue rather than an immediate code execution bug, but it still increases operational and security risk.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

Pydantic has known advisories in some versions, and the open-ended requirement prevents confirmation that only patched versions will be installed. This does not prove the current deployment is vulnerable, but it does show the manifest lacks the controls needed to verify that it is safe.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The pydantic-settings dependency is unpinned, so package resolution may pull different versions over time, reducing reproducibility and making it hard to prove that deployed builds are not affected by known issues. For configuration-handling libraries, version drift can be especially risky because they often process environment variables and secrets.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The unpinned pydantic-settings requirement makes it impossible to determine whether installs will include a version impacted by known advisories. Given that this package may influence how secrets and configuration are loaded, the lack of version certainty is a meaningful security hygiene issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

python-dotenv>=1.0.1 is not version-pinned, which permits uncontrolled upgrades and inconsistent dependency resolution across installations. Since this library commonly interacts with local environment configuration, unreviewed version changes can have security implications if an affected release is installed.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

python-dotenv has known advisories in parts of its version history, and because the manifest does not pin a specific version, consumers may install an affected release without noticing. In a service context, configuration-loading libraries can affect local file handling and environment parsing, so unverifiable version selection increases risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.