Security audit

时区管理服务

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a timezone API wrapper, but it has mismatched Gaokao references and stores a user API key in a local plaintext .env file while forwarding requests to a configurable remote endpoint.

Install only if you trust the Xiaobenyang service and are comfortable with your API key being written to a local plaintext .env file. Review and restrict the configured base URL before use, avoid running it in shared or source-controlled directories, and prefer a version that removes the stale Gaokao references, pins dependencies, validates the API endpoint, and stores secrets in a safer location.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/call_api.py:53
Finding: API Credential Exfiltration Through a Configurable Upstream Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config.py:42
Finding: API Key Persisted in a Plaintext File Without Enforced Access Controls
Content: View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis `save_api_key_to_env()` writes the API key in plaintext to `.env` in the process's current working directory. The implementation does not create the file with explicit owner-only permissions, verify permissions on an existing file, use a dedicated private configuration directory, or prevent symbolic-link traversal. The resulting permissions depend on the process umask and the state of any pre-existing `.env` file. In shared or incorrectly configured environments, another local account or process may be able to read the key. Because the destination is relative to the working directory, the credential can also be written into a source tree and accidentally included in source-control commits, archives, build contexts, or backups. ### Attack Path 1. The Skill prompts the user for an API key as required by its documented workflow. 2. `set_api_key()` calls `save_api_key_to_env()`. 3. The function writes `XBY_APIKEY=<secret>` into the working-dire ...[truncated 806 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Non-Reproducible Dependencies Installed Through Open-Ended Version Ranges
Content: View full analysis
=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1 ``` ### Technical Analysis Every dependency uses an open-ended minimum version and the project includes no reviewed lockfile or package hashes. Separate installations can therefore resolve to different, previously unreviewed future releases. This does not establish that the named packages are currently malicious. However, it weakens supply-chain integrity and reproducibility: a compromised, vulnerable, or incompatible future release satisfying the specified lower bound can be installed automatically. Without hashes, the installation process also lacks artifact-level verification against a reviewed dependency set. ### Attack Path 1. A deployment or user installs dependencies from `requirements.txt`. 2. The package resolver selects the latest available versions satisfying the `>=` constraints. 3. A newly compromised, vulnerable, or behaviorally incompatible release is selected without a source-code change in this project. 4. The dependency executes during import or normal Skill operation with the privileges of the hosting process. 5. Any malicious behavior in that dependency may access process data, environment variables, files, network resources, and the API credential available to the Skill. This is a supply-chain exposure rather than evidence that a malicious package is presently included. ### Impact Assessment The maximum potential impact is code execution with the privileges of the process installing or running the Skill. Such code could access the API key, tool parameters, local files available to the process, and network resources. Actual impact depends on whether an affected dependency version is resolved and on the runtime privileges assigned to the Skill. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to provide timezone features, yet the document indicates API-key persistence and even references a gaokao-oriented project structure. A misleading facade around unrelated functionality is dangerous because it can conceal credential handling and external data flows that users would not reasonably expect from a time conversion skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to provide timezone features, yet the document indicates API-key persistence and even references a gaokao-oriented project structure. A misleading facade around unrelated functionality is dangerous because it can conceal credential handling and external data flows that users would not reasonably expect from a time conversion skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file implements a generic proxy to an upstream MCP service by accepting arbitrary mcp_id, tool_name, and params and forwarding them directly to the upstream API. In a skill advertised as timezone management, this creates a capability mismatch: if the caller can influence these fields, the skill can invoke unrelated upstream tools, potentially expanding privileges, exposing data, or triggering unsafe actions beyond the declared scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The call_tool method places the caller-supplied tool_name directly into the func header and forwards arbitrary JSON params, enabling invocation of any upstream tool by name. That is effectively a general remote action primitive; in the context of a timezone skill, it is unnecessarily broad and could be abused to access non-timezone functionality available to the configured API key.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The configuration is clearly inconsistent with the declared timezone-management purpose: it references a different service domain, a gaokao-oriented env prefix, and an unrelated remote MCP identifier. This mismatch strongly suggests code reuse or hidden functionality, which is dangerous because users may grant trust and credentials to a skill whose real behavior is outside its stated scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring explicitly labels the file as configuration for a gaokao skill, contradicting the manifest's timezone-management identity. This kind of identity mismatch is a strong trust-boundary issue because it suggests the package may not do what it claims, increasing the risk of hidden or repurposed behavior.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.
python
model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.
python
model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: This code forcibly reads a specific API key from .env outside the standard settings mechanism, indicating deliberate credential collection for an unrelated service. In the context of a timezone skill, this makes secret access more suspicious because it exceeds user expectations and may facilitate unauthorized backend access.
Content: Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.
python
default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: Reading a live environment variable to override the API key enables the skill to consume externally provided credentials for an unrelated backend service. In a mislabeled timezone tool, this broad secret intake increases the chance of misuse and makes hidden service coupling more dangerous.
Content: Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.
python
if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: This function persists credentials in plain text to .env, creating durable local exposure of a secret tied to an unrelated service. If the host is shared, backed up, or the repository is mishandled, the API key can be recovered and abused, making the skill substantially more dangerous than its declared timezone role suggests.
Content: Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.
python
def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares no explicit tool scope or permissions while its documented behavior implies access to environment variables, file writes for credential persistence, and network/API calls. Missing scope boundaries increases the chance that an agent runtime grants broader capabilities than users expect, which is risky when the skill also handles secrets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to ask the user for an API key and persist it via set_api_key, but it does not warn the user that the credential will be stored or explain retention and protection. Collecting and storing secrets without transparent notice can lead to accidental disclosure, insecure persistence, and uninformed user consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow example calls a school-search function unrelated to timezone conversion, showing the skill documentation is likely copied from another project. In security terms, inconsistent operational instructions make the true behavior of the skill ambiguous and can hide unintended or unauthorized tool usage.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The project structure still identifies the package as a gaokao skill, contradicting the claimed timezone-service identity. Such inconsistencies are a red flag for repackaged or mislabeled skills and make it harder for reviewers to trust what code and external services are actually involved.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The class docstring is written only in Chinese, and additional user-facing strings in the file are also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The raised error text is presented only in Chinese, which can force a specific language on users. The file does not indicate that the skill is region-specific or provide any opt-in or fallback language behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The function docstring and failure message include Chinese-only text, and no language preference mechanism or scope limitation is documented. This creates a policy issue because the skill effectively enforces one language for user-facing communication.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This skill declares remote-service configuration and API credential handling even though timezone conversion normally does not require secret-backed external access. Unjustified credential collection expands the attack surface and creates a risk of covert data exfiltration, account abuse, or misleading users into supplying secrets to an unrelated backend.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code persistently stores an API key into a local .env file, which is unnecessary for a simple timezone skill and creates long-lived credential exposure on disk. Stored secrets can be recovered by other local processes, accidentally committed to source control, or reused beyond the user's intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function writes the API key to .env without any user-facing warning, confirmation, or explanation that the secret will be stored persistently. Silent credential persistence is risky because users may expect temporary use only, and the saved secret may later be exposed through filesystem access or accidental sharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: All user-facing instructions and metadata are written in Chinese, and the document does not indicate that other languages are supported or let the user opt into a preferred language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency is specified with a lower bound only, so builds may resolve to different versions over time. This weakens reproducibility and makes it hard to determine whether a deployed version includes known security fixes or vulnerable releases.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: Requests has multiple published advisories, but because the manifest does not pin the package, it is impossible to verify whether the installed version is affected. In a network-facing time zone service, an HTTP client is likely to be used, so unresolved dependency versioning increases uncertainty around exposure.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: Using an unpinned pydantic version allows environment-dependent resolution, which can introduce inconsistent behavior and uncertain exposure to vulnerable releases. This is a supply-chain hygiene issue rather than an immediate exploit by itself.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1