随机数生成工具

• Outcome: Review
• Latest audit: Jul 3, 2026 · 6:55 PM UTC
• Version: 1.0.1

Overview

This skill is advertised as a random-number generator, but it requires a third-party API key, sends requests to an external service, and stores the key in a plaintext .env file.

Install only if you intentionally want a XiaoBenYang-backed remote API client for random-number requests and are comfortable sending the API key and all function inputs to that service. Do not use it for secrets, authentication tokens, sensitive lists, or private datasets; a local random generator would be safer and more appropriate.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares itself as a simple random-number utility, yet it appears to use environment access, file read/write, and network capabilities without declaring them. That hidden capability expansion matters because users and reviewers would reasonably expect local-only randomness, not credential handling and outbound API use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This is a strong description-behavior mismatch: the skill advertises random number generation, but the workflow requires an external API, reads and persists API keys, and returns remote data. Such mismatch undermines informed consent and can trick users into disclosing credentials for functionality that should not require them.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: A random-number tool has no legitimate need to demand a gaokao-related API key, making this instruction highly inconsistent with the claimed function. That incongruity increases the risk of deceptive credential collection because users are prompted to provide secrets unrelated to the advertised capability.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documented workflow says the code is an API-calling router that returns raw external responses, which is incompatible with a local random-number generator. This indicates the skill is acting as a disguised API client, broadening data exposure and creating opportunities for unnecessary secret collection and remote data handling.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The project structure and return-value handling describe an external API client architecture rather than a randomness utility. When packaging and interface details contradict the declared purpose, the skill can mislead operators about what data leaves the environment and what secrets are stored.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Collecting an API key and accessing an external service are unnecessary for generating random numbers, so these capabilities exceed the legitimate functional scope. Unnecessary sensitive flows increase attack surface and normalize asking users for credentials when no such need exists.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file claims to support random-number generation, but its actual behavior is a generic remote MCP API client that can invoke arbitrary upstream tools via caller-controlled mcp_id, tool_name, and params. This mismatch is dangerous because it hides network-capable functionality behind an innocuous skill description, defeating user expectations, review controls, and least-privilege assumptions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: A random-number utility should not need broad outbound HTTP capability, yet this code creates a reusable session and posts arbitrary parameters plus control headers to an external service. In this skill context, hidden network access materially increases danger because the tool can exfiltrate data or act as a proxy to unexpected remote functionality unrelated to its declared purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements configuration and credential management for an unrelated '高考' service, including API endpoint, ID, and API key handling, despite the declared skill being a random-number utility. This capability mismatch is a strong indicator of hidden or repurposed functionality and creates a path for unauthorized external service access using user-provided credentials.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code explicitly reads, stores, and persists an API key in both process environment and a local .env file, behavior that is not justified by a random-number tool. In the context of a mismatched skill, credential collection and persistence materially increase the risk of secret retention, later misuse, or unauthorized outbound access.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The class docstring labels this as '高考Skill配置', directly contradicting the published skill identity as a random-number generator. This inconsistency is a strong signal of code reuse or deceptive packaging, which undermines trust and suggests the skill may perform hidden functions outside its declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as a local random-number utility, but every operation is delegated to an external API via `call_api`. This creates an unexpected data-flow boundary and trust dependency: inputs, outputs, and any claim of randomness or cryptographic security now depend on a remote service that the caller cannot inspect or verify.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A random generation tool does not need network access to fulfill its stated purpose, yet all functions invoke a remote API. This unnecessarily expands the attack surface, allows response manipulation, creates availability and integrity risks, and undermines confidence in purportedly secure randomness.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the model to ask the user for an API key and save it, but it does not clearly warn about persistence, storage location, retention, or privacy implications. That can cause users to disclose sensitive credentials without understanding they will be written to disk and reused later.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The request transmits both the API key and all tool parameters to an upstream service, but this file provides no user-facing indication that supplied inputs will leave the local environment. That creates a confidentiality and transparency risk, especially if callers pass sensitive values believing this is a local random utility.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function writes API credentials to a plaintext .env file without any user-facing warning, consent flow, or discussion of storage risk. Plaintext credential persistence can expose secrets through source control mistakes, local file disclosure, backups, or shared environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: `random_int` forwards user-supplied arguments to a remote API without any disclosure in this file that inputs leave the local environment. Even if the data seems low sensitivity, hidden transmission violates least surprise and can expose usage patterns or application state to an external service.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: `random_float` sends its arguments to a remote API without warning or consent in the implementation shown. This creates an unnecessary privacy and trust issue for a utility that should be local and deterministic in its data handling boundaries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `random_choices` may transmit the full `population` and optional `weights` to an external API, which can directly leak user-provided datasets. In skill context this is more dangerous because a caller may reasonably pass sensitive lists, assuming a harmless local helper, while the code silently exports them remotely.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `random_shuffle` transmits the entire `items` list to an external API without disclosure. Because shuffling often operates on user content, identifiers, or candidate sets, this can leak complete datasets to a remote service under the guise of a basic utility.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `random_sample` sends the supplied `population` and sample size to a remote API without telling the user. This is risky because sampling is commonly applied to internal records or sensitive lists, and the remote dependency is not aligned with the tool's stated purpose.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: `secure_token_hex` claims secure token generation but obtains the token from an external API without disclosing that fact. In this context the risk is higher because token secrecy and unpredictability are security properties; a remote service could log, reproduce, bias, or exfiltrate generated tokens, completely breaking their use for authentication or password resets.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: `secure_random_int` relies on an external API for supposedly secure randomness without warning the caller. For security-sensitive use, this is dangerous because the remote service can bias outputs, observe requests, or return predictable values, compromising protocols that depend on unbiased secret randomness.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill creates a natural-language flow for soliciting and persisting a user-provided API key, which is a sensitive credential-handling pattern. Because the skill's advertised purpose does not justify secret collection, this increases the likelihood of inappropriate credential capture and retention.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Directly reformatting and presenting raw API response data without filtering can expose sensitive or irrelevant content returned by the external service. In a mislabeled skill already handling credentials and remote data, that practice further increases the risk of accidental disclosure.

Static analysis

No suspicious patterns detected.