顺序思维服务

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 1.0.1

Overview

This skill is a Review item because it sends detailed reasoning content to a third-party API and stores the required API key in a local plaintext .env file with incomplete scoping and privacy disclosure.

Install only if you are comfortable sending the tool's reasoning inputs to Xiaobenyang's API and storing the API key in a local .env file. Do not submit secrets, regulated data, private code, or confidential business context through this skill unless the publisher documents retention, deletion, endpoint controls, and safer credential storage.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tools.py:88

Finding

Unredacted User Reasoning Is Transmitted to an External Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:9

Finding

Configurable API Origin Can Receive API Credentials and User Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/config.py:43

Finding

API Key Is Persisted in a Plaintext File Without Enforced Access Permissions

Content

View full analysis

bool: """Save the API key to the .env file""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return False ``` ### Technical Analysis The function stores the API key as plaintext in `.env` using `Path.write_text()`. It does not explicitly create the file with owner-only permissions, inspect the permissions of an existing file, prevent symbolic-link traversal, or use atomic replacement. The resulting access permissions depend on the process umask and pre-existing file mode. In a shared or improperly configured environment, the file may be readable by other local users. If `.env` is inside a repository and is not excluded by version-control configuration, it may also be committed or included in backups and build artifacts. The non-atomic read-modify-write sequence creates an additional integrity risk: another local process may replace or redirect the path between checks and the write operation. ### Attack Path 1. A user provides an API key as required by the Skill workflow. 2. `set_api_key()` calls `save ...[truncated 1088 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation claims iterative reasoning functionality, but the described implementation instead reads/writes a local .env file, manages XBY_APIKEY, and stores connection settings for an external service. That hidden configuration-management and secret-persistence behavior materially expands the attack surface and can expose secrets or modify local state under the guise of a harmless thought tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documentation claims iterative reasoning functionality, but the described implementation instead reads/writes a local .env file, manages XBY_APIKEY, and stores connection settings for an external service. That hidden configuration-management and secret-persistence behavior materially expands the attack surface and can expose secrets or modify local state under the guise of a harmless thought tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The configuration is clearly for a different product/domain ('小笨羊高考', XBY_GAOKAO, xiaobenyang.com) than the declared sequential-thinking service. This mismatch is dangerous because it can cause the skill to silently connect to an unrelated external service and route user data or credentials outside the expected trust boundary, which is especially concerning for an MCP service whose stated purpose does not require this backend.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The code explicitly and forcibly reads a specific API key from .env during post-initialization, bypassing normal settings abstractions and coupling the skill to local secret files. In the context of a mismatched skill, this increases the risk of unintended credential harvesting or use of locally stored secrets for an unrelated external service.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Creating a hardcoded Path('.env') for manual secret access is part of an unnecessary credential-access workflow in a skill that does not obviously need such behavior. This strengthens the possibility of unauthorized or non-transparent use of developer-local credentials, especially given the unrelated service branding and external endpoint.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This function is dedicated to persisting API credentials into a .env file, creating durable local secret storage for a service whose stated purpose does not justify it. If exploited through local file access, repo inclusion, backups, or support bundles, the credential could be stolen and used against the linked third-party service.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though the documented/project capabilities include environment access, local file read/write, and outbound network use. In an agent setting, missing scope declarations increases the chance of over-privileged execution, unexpected data access, and unreviewed secret handling, especially because the skill also instructs collecting and persisting an API key.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is presented primarily in Chinese and labels requirements as mandatory, while not stating that users may interact in another language or choose their preferred locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document simultaneously describes the skill as a sequential-thinking tool and mandates asking for and saving an API key, which signals conflicting implementation intent. That inconsistency raises the risk of covert credential collection or at minimum confusing secret-handling behavior in a context where users would not expect authentication or persistent storage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The project structure and workflow reference unrelated gaokao-school-selection modules and examples, which indicates copy-paste drift and documentation inconsistency. In security terms, this can mislead reviewers about what code is actually being invoked, hide unintended external integrations, and cause operators to trust the skill under false assumptions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This module reads, stores, and updates a third-party API key even though the advertised skill is a sequential-thinking service, not an external API proxy. Unnecessary credential management expands the attack surface, increases the chance of secret exposure, and suggests hidden external service dependence that users would not reasonably expect from the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function writes the supplied API key directly into a local .env file and updates process environment state without any user-facing confirmation, warning, or consent flow. Persisting secrets to disk by default can expose them through backups, repository accidents, local file disclosure, or shared workstation access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool docstring explicitly instructs the agent to generate, verify, and repeat chain-of-thought reasoning, which encourages disclosure and external handling of internal reasoning steps. In an MCP/tool setting, this can cause sensitive hidden reasoning or intermediate analysis to be transmitted via tool arguments or API calls, increasing prompt leakage and data exposure risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only (requests>=2.31.0), which makes builds non-reproducible and allows future installs to pull in unexpected versions. This increases supply-chain risk and makes it hard to verify whether a deployed environment includes a vulnerable or incompatible release.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

requests has multiple known advisories, and because the manifest does not pin a specific version, it is impossible to verify from this file alone whether the installed release is affected. In a network-capable service, uncertainty around an HTTP client library is meaningful because vulnerable versions could expose credentials, TLS/session handling, or request-processing weaknesses.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is unpinned (pydantic>=2.7.0), so installations may resolve to different versions over time. That weakens reproducibility and can expose the project to newly introduced vulnerable releases or breaking behavior without any code changes.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

pydantic has known advisories, but the unpinned requirement prevents verification of whether deployed instances use a safe version. Given this skill likely processes structured input, a vulnerable parsing or validation library could affect availability or input-handling safety if an affected version is resolved.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Using pydantic-settings>=2.2.0 without an exact pin means the installed version is not deterministic. This can lead to accidental adoption of insecure or incompatible versions and complicates incident response when trying to determine affected deployments.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

pydantic-settings has at least one advisory, and the open version specifier makes the installed version unverifiable. If the service reads secrets or configuration from the filesystem, an affected version could increase risk around secret source handling depending on runtime usage.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The requirement python-dotenv>=1.0.1 is not pinned, so package resolution may select any later release. This creates avoidable supply-chain uncertainty and makes it difficult to prove that known-bad versions are not being installed.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

python-dotenv has known advisories, and the unpinned dependency means the manifest does not demonstrate that a safe version will be installed. Because dotenv libraries often interact with local configuration files, vulnerable versions can matter if the application loads or modifies .env files in attacker-influenced paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The class docstring contains a Chinese-only description, which may indicate a fixed language choice without offering the user a locale or language option. Under the policy, language constraints should be optional or clearly justified rather than implicitly enforced.

Content

No source excerpt is available for this finding.