电影搜索工具

• Outcome: Review
• Latest audit: Jul 3, 2026 · 1:34 PM UTC
• Version: 1.0.1

Overview

This movie-search skill mostly matches its purpose, but it stores and reuses a service API key from a plain local .env file with confusing leftover configuration from another skill.

Install only if you trust XiaoBenYang with your movie search queries and API key. Use a dedicated key, avoid installing from a shared or version-controlled workspace, and check whether an existing .env already contains XBY_APIKEY before running it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation describes capabilities that include reading environment variables, writing local configuration, and making network requests, but it does not declare those permissions explicitly. This weakens user and platform visibility into what the skill can access, making secret handling and outbound data flow harder to audit. In this context, the risk is elevated because the skill also solicits an API key and persists it locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The stated purpose is a movie/TV search tool, but the documented behavior includes persisting API keys to local .env storage and forwarding requests to a remote API rather than implementing the claimed functionality locally. This mismatch is dangerous because users may grant trust based on a benign description while hidden data-handling behavior exposes credentials or routes sensitive usage metadata to an external service.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The configuration clearly references a different skill identity ('高考') and a different key namespace/service ('XBY_APIKEY', 'XBY_GAOKAO_') than the declared movie-search tool. This mismatch can cause the tool to read or overwrite credentials intended for another skill or service, creating cross-skill secret confusion and accidental data exposure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to ask the user for an API key and then save it via set_api_key, but it does not clearly warn the user that the credential will be persisted to local configuration. This creates a secret-handling vulnerability because users may disclose a credential expecting transient use, while the skill stores it on disk where it may be exposed to other processes, users, or future sessions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code persists the API key into a local .env file without any visible consent flow, storage warning, or permission hardening. On multi-user systems, shared workspaces, or repositories, this increases the chance of credential leakage through local file exposure, backups, syncing, or accidental commits.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 86% confidence
• Finding: The code forcibly parses .env and extracts XBY_APIKEY regardless of the declared env_prefix, bypassing normal settings scoping. In the context of a movie-search skill with mismatched identity, this can pull credentials from an unrelated application and silently bind this skill to the wrong account or service.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 86% confidence
• Finding: Opening and reading the entire .env file manually increases the chance of cross-scope secret handling and bypasses safer configuration abstractions. In this skill, the hard-coded lookup for a foreign key name makes the behavior more dangerous because it may consume secrets unrelated to the declared tool.

Credential Access

High

• Category: Privilege Escalation

Content

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

• Confidence: 83% confidence
• Finding: The explicit fallback to os.getenv('XBY_APIKEY') continues the same cross-skill credential confusion by prioritizing a generic or foreign key name over a skill-specific namespace. This can unintentionally import secrets from the runtime environment and direct requests under the wrong credentials.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 89% confidence
• Finding: The function is explicitly designed to persist an API key into .env, creating a plaintext secret-at-rest risk. If the workspace is shared, synced, backed up, or accidentally committed, the credential can be disclosed and abused.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 87% confidence
• Finding: This method advertises persistent API-key storage as standard behavior, which normalizes writing credentials to a plaintext local file. In a skill ecosystem, that increases the chance that users unknowingly leave durable secrets on disk where other tooling or collaborators may access them.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower-bound only (requests>=2.31.0), which allows installation of different future versions and reduces build reproducibility. This is a supply-chain hygiene weakness because unreviewed upstream releases could be pulled in automatically, though it is not by itself an actively exploitable code flaw in this file.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 93% confidence
• Finding: The dependency is unpinned (pydantic>=2.7.0), so environments may resolve to different versions over time. That creates non-reproducible installs and increases supply-chain exposure if a future release introduces a security issue or breaking behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 92% confidence
• Finding: Using pydantic-settings>=2.2.0 permits automatic adoption of any later release, which weakens reproducibility and dependency control. While not an exploit on its own, it can increase exposure to accidental or malicious upstream changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 93% confidence
• Finding: python-dotenv>=1.0.1 is unpinned, allowing future versions to be installed without explicit review. This is a low-severity supply-chain risk because dependency resolution may pull in unexpected code or behavior changes.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The requirements entry permits requests 2.31.0, and that version is associated with multiple advisories. Because this skill is a network-facing search tool that likely performs outbound HTTP requests and URL handling, vulnerable requests behavior is more relevant than in a non-networked utility, increasing practical risk if the affected code paths are used.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: The requirements allow python-dotenv 1.0.1, which is flagged for a symlink-following arbitrary file overwrite issue in set_key. This is relevant only if the skill actually invokes dotenv writing functionality on attacker-influenced paths, so the current file indicates a real dependency risk but not proof of exploitability by itself.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.