Security audit
Security checks for vulnerabilities and agentic risk
This random-number skill is routed through a third-party API, stores an API key in plaintext, and sends random-generation inputs off-device, which is overbroad for the stated purpose.
Review before installing. This skill is not a local random generator: it requires a XiaoBenYang API key, stores that key in a plaintext .env file, and sends random-generation requests and parameters to an external service. Do not use it for passwords, reset tokens, session secrets, private lists, or environments where outbound requests or plaintext credential storage are not acceptable.
scripts/config.py:48API Key Persisted in a Plaintext File Without Restrictive Permissions
scripts/config.py:9Configurable API Endpoint Can Redirect Credentials to an Attacker-Controlled Server
The skill claims to generate random values, yet the documentation states it reads and writes .env files, persists API keys, mutates process environment variables, and manages network configuration. That is a substantial hidden capability expansion that risks credential exposure and unauthorized configuration changes under a misleading interface.
The skill claims to generate random values, yet the documentation states it reads and writes .env files, persists API keys, mutates process environment variables, and manages network configuration. That is a substantial hidden capability expansion that risks credential exposure and unauthorized configuration changes under a misleading interface.
Requiring an external API key for a purported random-number tool is a strong semantic inconsistency and suggests the skill is doing more than advertised. Users may provide sensitive credentials under false assumptions, creating unnecessary exposure and trust abuse.
The workflow says the model should call APIs and return raw API data, which conflicts with the expected behavior of a local random utility. This broadens risk from simple computation to remote data exchange, making prompt users vulnerable to hidden exfiltration or unreviewed upstream content.
The file claims to belong to a random-number tool, but its implementation is actually a generic remote MCP API client that can invoke arbitrary upstream functions via attacker-controlled headers and parameters. This functionality materially differs from the declared skill purpose, creating a strong indicator of deceptive capability hiding and enabling unauthorized remote operations under the guise of a benign utility.
The code establishes outbound HTTP(S) access and sends authenticated requests to a remote API, with the called function selected dynamically from input (tool_name) and the target context influenced by mcp_id. In the context of a supposed random-number generator, this is unjustified hidden capability that could be abused for covert data exchange, remote command brokering, or invoking unintended external tools with the stored API key.
The file’s behavior materially diverges from the declared skill purpose: instead of random-number functionality, it implements configuration for an external service and API key handling. That mismatch is dangerous because hidden credential-management capabilities can be used to collect, overwrite, or persist secrets under a misleading benign label, reducing user scrutiny and increasing supply-chain risk.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
model_config = SettingsConfigDict(
env_prefix="XBY_GAOKAO_",
env_file=".env",
env_file_encoding="utf-8",
extra="ignore",
)
This code reads, stores, and exposes an API key even though the skill is presented as a random-number tool. In context, unrelated credential access is especially suspicious because it creates an unnecessary secret-handling surface that could facilitate credential theft, persistence, or abuse of another service.
This code explicitly forces reading XBY_APIKEY from a local .env file, adding custom secret extraction logic beyond normal settings behavior. In a skill that should only generate random values, this unauthorized secret access is especially dangerous because it broadens credential exposure without any functional justification.
default_year: int = 2025
def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")
The direct read of the .env file is part of a custom credential-access path unrelated to the advertised skill function. Custom file-level secret reads make it easier to harvest or manipulate credentials and bypass clearer configuration boundaries that users might expect.
def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")
for line in content.splitlines():
The code gives precedence to an environment variable and copies it into the settings object, further propagating sensitive credential material in memory. While common in some applications, within this mislabeled skill it contributes to unnecessary handling of secrets and increases the chance of accidental exposure through debugging, serialization, or future misuse.
if line.startswith("XBY_APIKEY="):
self.api_key = line.split("=", 1)[1].strip()
break
# 如果环境变量有值，覆盖 .env 的值
env_val = os.getenv("XBY_APIKEY", "")
if env_val:
self.api_key = env_val
This function is explicitly designed to persist an API key to a .env file, creating a plaintext at-rest copy of the credential. Plaintext secret storage significantly raises the risk of credential compromise through local file disclosure, backup leakage, accidental commits, or access by other components on the host.
def save_api_key_to_env(api_key: str) -> bool:
"""将API key保存到.env文件"""
try:
env_path = Path(".env")
lines = []
if env_path.exists():
lines = env_path.read_text(encoding="utf-8").splitlines()
The secure_token_hex helper delegates security-sensitive token generation to an external API without warning. This is particularly dangerous because the remote service could predict, log, reuse, or bias tokens, completely undermining secrecy and enabling account takeover, session forgery, or reset-link compromise.
The skill declares itself as a simple random-number generator, but the documentation indicates capabilities involving environment access, file read/write, and network usage without any explicit tool scope restrictions. This over-privileging increases attack surface because a caller or downstream implementation may use sensitive capabilities that are unnecessary for local randomness generation.
The skill instructs the system to ask the user for an API key and save it, but it provides no warning about credential storage, persistence, or handling risks. This can lead to secrets being collected and written to disk without informed consent or secure storage practices.
The return-value and project-structure sections reveal an API client and direct presentation of external JSON, which is inconsistent with a random tool and can expose users to unnecessary third-party data handling. Even if no direct exploit is shown, this hidden dependency increases the chance of sensitive data leakage and unsafe output handling.
The instruction to directly display raw API data creates a realistic risk of exposing sensitive information returned by the upstream service, including reflected user inputs, operational metadata, or even credentials if mishandled by the backend. Returning unsanitized raw responses also increases the chance of prompt/content injection and accidental disclosure.
This code includes Chinese-only docstrings, exception messages, and return messages such as 'API密钥未设置，请先调用 set_api_key()' and 'API调用失败', which imposes a specific language on users without any visible opt-in or locale selection. The policy explicitly disallows forcing a specific language unless the constraint is documented and justified or the user is given a choice.
The class docstring identifies the code as configuration for a different '高考Skill', contradicting the declared '随机数生成工具' purpose. Such identity mismatch is a strong indicator of repurposed or deceptive code, which can conceal unauthorized behavior and undermine trust in the package contents.
The function persists an API key into a local .env file without an explicit user-facing warning or confirmation at the time of storage. Writing secrets to plaintext files can leave credentials exposed to other local users, backups, logs, repository accidents, or later exfiltration by unrelated code.
The skill is presented as a local random-number utility, but every operation is delegated to a remote API via call_api. This creates an unexpected trust boundary: callers may assume randomness is generated locally while inputs, outputs, and security-sensitive operations depend on an external service that could observe, manipulate, or fail requests.
A random-number tool should not generally require network capability, yet this file introduces broad external API invocation for all helper functions. That enlarges the attack surface by enabling data exfiltration, output tampering, dependency on remote availability, and hidden behavior inconsistent with the stated purpose of the skill.
The random_int helper transmits caller-supplied arguments to an external API without visible disclosure. Even seemingly simple numeric inputs create an undisclosed outbound data flow and normalize hidden network access in a tool whose purpose does not imply remote processing.
The random_float helper sends its parameters to a remote API without telling the user or caller. This undisclosed data transfer is risky because consumers may use the function in contexts that prohibit outbound communication or assume deterministic local-only behavior.