车牌识别

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 10:06 PM UTC
• Version: 1.0.0

Overview

This is a coherent license-plate recognition skill that uses a disclosed third-party API, but users should understand that images and an API key leave or persist outside the immediate chat.

Install only if you are comfortable sending license plate images or image links to XiaoBenYang's API and storing the XiaoBenYang API key in a local plaintext .env file. Avoid using it with sensitive, regulated, or third-party images unless you have permission and understand the provider's privacy and retention terms.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes capabilities to read environment variables, write files, and make network calls, yet it declares no explicit permissions. This creates a transparency and governance gap: users and hosting platforms may not realize the skill can persist secrets and transmit data externally. In this context, the hidden combination of env/file/network access is especially relevant because the skill asks for an API key and sends user image data to a remote service.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file persists and manages an unrelated credential named XBY_APIKEY even though the declared skill is only for license plate recognition. This mismatch strongly suggests code reuse or hidden external-service coupling, which expands the trust boundary and can expose sensitive credentials through local storage and later misuse.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code writes API keys into a local .env file, creating durable secret storage on disk without necessity being justified by the skill's stated purpose. Local persistence increases the chance of credential disclosure through source control, backups, shared workspaces, or other processes reading the file.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The docstring identifies the configuration as belonging to a different skill domain, which indicates copy-pasted or mislabeled code inconsistent with the manifest. In security review, this matters because mismatched identity and purpose can conceal unintended behaviors, such as external API access and secret handling unrelated to the declared capability.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill sends user-supplied image URLs or base64-encoded image content to an external API, but it does not warn users that their images will leave the local environment. This is a privacy and consent issue, especially because images may contain sensitive location, vehicle, or bystander information beyond just the plate itself.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The function persists the provided API key to .env immediately and silently, without any user-facing notice, consent, or explanation of storage location. This is dangerous because users may believe the key is used only for the current session while it actually remains on disk and can later be accessed by other tools or users.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This function sends a user-supplied image URL to an external API for license plate recognition, but the file provides no disclosure, consent flow, or privacy warning. Because license plate images can contain personal or regulated data, silent transmission to a third party creates a real data privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This function transmits raw base64-encoded image content directly to an external API without any user-facing disclosure in the code. Since the payload may contain sensitive personal data, the lack of transparency and consent makes this a genuine privacy/security issue, especially in environments with data residency or PII restrictions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to collect a user API key, persist it via configuration, and continue processing, but it does not define secure handling, scoping, masking, or storage protections. It also couples this with direct presentation of raw API output, which increases the chance that secrets or unexpected sensitive fields could be exposed through logs, prompts, or responses.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Instructing the model to directly display raw API response data without redaction or schema validation can leak sensitive or irrelevant fields returned by the upstream service. If the API includes debugging metadata, internal identifiers, echoed credentials, or unexpected content, the agent may expose it verbatim to the user.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 95% confidence
• Finding: The code forcefully reads .env and extracts XBY_APIKEY during model initialization, bypassing normal scoped configuration expectations and tying the skill to local credential discovery. In the context of an unrelated license-plate skill, this unauthorized secret loading expands access to credentials that users may not expect this component to touch.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 95% confidence
• Finding: This code explicitly opens and reads the local .env file to search for an API key, which is direct credential access behavior. Given the mismatch between the skill's described function and the credential being accessed, this makes the file more suspicious and increases the chance of unintended secret exposure.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 99% confidence
• Finding: This function is dedicated to saving an API key into .env, which is plaintext local credential persistence. Persisting secrets in this way materially increases exposure risk and is especially unjustified when the skill description does not establish a need for managing unrelated credentials.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 98% confidence
• Finding: The setter function is explicitly designed to persist an API key to .env, embedding credential-management capability into a skill that appears unrelated to such behavior. This widens the attack surface by normalizing secret storage and making long-lived credentials easier to leak or misuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), so installs may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce breaking changes or newly published vulnerable releases into the skill's environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: `pydantic>=2.7.0` is unpinned, which means builds are not reproducible and future releases may change behavior or introduce security issues. Even if no specific CVE is cited here, supply-chain risk increases when versions are allowed to float.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: `pydantic-settings>=2.2.0` allows any later version to be installed, reducing determinism and increasing supply-chain exposure. This can lead to accidental adoption of insecure or incompatible releases without code changes in the skill itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: `python-dotenv>=1.0.1` is unpinned, so deployments may pick up different versions over time. That increases the chance of supply-chain drift, including introduction of vulnerable versions or unexpected behavior changes.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirement permits `requests` 2.31.0 and later, and static analysis identifies 2.31.0 as having multiple advisories, including credential leakage and request verification issues. If dependency resolution selects 2.31.0, the skill may inherit network-layer weaknesses, which is more relevant here because a license-plate recognition skill is likely to call external APIs or fetch remote resources.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The requirement permits `python-dotenv` 1.0.1, and the cited advisory indicates symlink-following behavior in `set_key` could enable arbitrary file overwrite in certain usage patterns. The danger depends on whether the skill actually invokes vulnerable write paths, so this is lower impact in this file alone, but it remains a genuine dependency risk.

Static analysis

No suspicious patterns detected.