ClawHub
Back to skill

Security audit

OECD数据查询服务

Security checks across malware telemetry and agentic risk

Overview

The skill appears aimed at OECD data lookup, but it routes queries and a locally saved API key through a third-party XBY MCP service with enough under-disclosure to warrant Review.

Install only if you are comfortable giving an XBY/xiaobenyang API key to this skill and having it saved in a local .env file. Treat it as a third-party hosted MCP client for OECD-style data queries, not as a direct OECD-only integration; use a limited/revocable key if available and avoid installing it in repositories where .env files may be committed or shared.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares no permissions while its documented behavior clearly requires environment access, local file read/write, and network calls. This creates a transparency and governance gap: users and hosting platforms cannot accurately assess or constrain what the skill will do, especially because it also persists credentials locally.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose says this is an OECD SDMX data query service, but the skill also manages API keys locally and appears to call a third-party XBY aggregation service instead of directly exposing or implementing the stated OECD access path. Description-behavior mismatch is dangerous because it can mislead users into disclosing credentials and trusting a different data path than advertised.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill requires a custom XBY API key and directs the model to collect it from the user, which is inconsistent with a purported OECD SDMX query skill. In context, this raises phishing and credential-diversion concerns: users may believe they are authenticating to OECD-related infrastructure when they are actually supplying secrets for an unrelated third-party service.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The implementation does not match the declared OECD SDMX data-query purpose: it is a generic proxy that forwards arbitrary requests to a configurable MCP endpoint using caller-controlled tool metadata. This kind of capability mismatch is dangerous because users or downstream systems may trust the skill as a constrained OECD data client when it can actually reach unrelated upstream functions, increasing the risk of unauthorized actions or data access through deceptive packaging.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The function accepts caller-supplied tool_name and params and sends them directly to the upstream service via headers and JSON body, effectively exposing arbitrary upstream tool invocation. In the context of a skill advertised as an OECD data query service, this is especially risky because it expands the attack surface from read-only dataset retrieval to potentially any action the upstream MCP server supports, violating least privilege and enabling misuse under a trusted label.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code persists an API key to a local .env file and keeps helper functions for writing and retrieving that secret, which expands the skill from simple OECD data retrieval into local secret management. Persisting credentials on disk increases exposure through accidental commits, permissive file permissions, local compromise, or reuse by unrelated code.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
A read/query-oriented OECD data skill normally only needs to consume configuration, not implement local secret storage and mutation helpers. Adding write-capability for secrets creates unnecessary attack surface and can enable unintended credential retention on disk.

Intent-Code Divergence

Low
Confidence
83% confidence
Finding
The configuration is branded for an unrelated 'XBY_GAOKAO' context despite the skill being presented as an OECD data service. This mismatch is suspicious because it can cause operators to load or overwrite the wrong credentials, increasing the chance of secret mix-ups and misrouting to unrelated infrastructure.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The write path silently stores a sensitive API key into .env and also exports it into the current process environment without any warning, prompt, or disclosure. Users may assume the key is used transiently when it is actually persisted, creating avoidable secret exposure and retention risk.

Credential Access

High
Category
Privilege Escalation
Content
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
Confidence
89% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():
Confidence
89% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
Confidence
95% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()
Confidence
94% confidence
Finding
.env"

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
pydantic>=2.7.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
pydantic-settings>=2.2.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
python-dotenv>=1.0.1

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
84% confidence
Finding
requests==2.31.0

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
78% confidence
Finding
python-dotenv==1.0.1

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.