菜谱查询工具

• Outcome: Review
• Latest audit: Jul 3, 2026 · 5:13 PM UTC
• Version: 1.0.1

Overview

This skill appears to be a recipe lookup tool, but its artifacts show mismatched gaokao-related configuration and persistent plaintext API-key handling that users should review before installing.

Install only if you are comfortable with a skill that may contact an external API and store an API key in a local .env file. Review the gaokao/XBY_APIKEY mismatch first, confirm the real backend and data sent, avoid committing .env files, and prefer a secure secret store or non-persistent key entry.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes capabilities that read environment data, persist an API key to .env, and make network calls, yet it declares no permissions. This creates a transparency and consent problem because an agent or user may invoke the skill without understanding that local files, secrets, and external network access are involved.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a simple recipe lookup tool, but its behavior includes secret collection, persistence of the secret to local storage, and outbound requests to a remote API. That mismatch is dangerous because it can mislead users and reviewers about the actual trust boundary, increasing the risk of unintended secret disclosure or unauthorized external communication.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The documentation contains inconsistent examples and project structure references to school/gaokao tooling rather than recipe functionality. Such inconsistencies are a red flag for copy-paste errors or repurposed code, which can cause the agent to invoke unintended functions, send wrong parameters, or expose data to the wrong backend.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The configuration clearly targets a different domain ('gaokao') than the declared recipe-query skill, including mismatched env prefixes and comments. This kind of cross-skill code reuse is dangerous because it can connect the skill to an unintended backend, mishandle secrets, and hide behavior that users would not expect from a recipe CLI tool.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This skill stores and manages an external API credential even though the declared functionality is a simple command-line recipe lookup tool. Unnecessary credential handling expands the attack surface, risks accidental disclosure through local files or process environment, and suggests hidden dependency on an external service outside the user's expectations.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The file metadata and inline documentation are inconsistent, identifying the code as a gaokao-skill configuration rather than a recipe tool. Such inconsistencies are a supply-chain red flag because they can conceal repurposed code, confuse reviewers, and make it easier for unsafe behavior to pass unnoticed.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code writes the API key into a local .env file and process environment with no warning, consent flow, or discussion of persistence. This can expose secrets to other local users, accidental commits, backups, logs, or downstream tools that inspect environment variables.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 90% confidence
• Finding: The code explicitly reads .env and extracts XBY_APIKEY outside the normal settings framework, forcing credential loading from a plaintext local file. This increases secret exposure risk and bypasses safer centralized configuration handling, especially concerning in a skill whose stated purpose does not justify credential management.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 90% confidence
• Finding: By opening and reading the .env file directly, the code accesses credentials in plaintext and expands the number of places where secret-handling bugs can occur. In the context of a recipe-query skill, this is especially suspicious because the implementation is handling credentials more aggressively than the advertised functionality suggests.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 96% confidence
• Finding: This function is explicitly designed to save an API key into a plaintext .env file, creating a durable local secret that may be leaked via source control mistakes, filesystem access, editors, or backups. Persisting secrets this way is unsafe by default and unjustified for the declared simple recipe CLI context.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 95% confidence
• Finding: The function's stated purpose is to set and persist the API key into .env, normalizing insecure plaintext secret storage as part of application behavior. This increases the likelihood of credential compromise and is difficult to justify for a tool presented as a recipe lookup utility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), which permits installation of any future release, including versions with breaking changes or newly introduced supply-chain risk. In a tool that makes network requests, dependency drift can reduce reproducibility and unexpectedly pull vulnerable or incompatible packages into deployments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: `pydantic>=2.7.0` is unpinned, so builds are not reproducible and may resolve to future versions that change validation behavior or introduce security defects. While not directly exploitable on its own, this weakens supply-chain control and complicates safe deployment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: `pydantic-settings>=2.2.0` allows uncontrolled future upgrades, which can alter configuration parsing behavior or pull in vulnerable transitive dependencies. This is a supply-chain hygiene issue that increases operational and security risk over time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 95% confidence
• Finding: `python-dotenv>=1.0.1` is unpinned, so environment-loading behavior can change unexpectedly across installations and may introduce vulnerable releases later. For a CLI-oriented skill that likely relies on local configuration, unpredictable dependency resolution is a genuine but low-severity supply-chain concern.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The requirement permits installation of `requests` 2.31.0, a version with published advisories including credential leakage via malicious URLs and session verification flaws. Because this skill is a command-line recipe query tool and likely performs outbound HTTP requests, using a vulnerable HTTP client increases the chance that attacker-controlled URLs or responses could expose credentials or weaken transport security.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The dependency constraint allows `python-dotenv` 1.0.1, which is reported as vulnerable to symlink-following file overwrite in `set_key`. This is only exploitable if the skill actually invokes the affected write path on attacker-influenced `.env` locations, so the context does not make it highly dangerous, but it remains a real dependency risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.