Security audit
Security checks for vulnerabilities and agentic risk
The skill appears purpose-aligned for literature search, but it needs review because it persists a third-party API key in a local plaintext .env file without clear storage controls or opt-out.
Review this skill before installing. It is not showing destructive behavior or hidden exfiltration, but using it means giving a XiaoBenYang API key to the agent and allowing the skill to store that key in a local plaintext .env file. Prefer a disposable or narrowly scoped key, keep .env out of source control and backups, rotate the key if exposed, and avoid entering sensitive unpublished research queries unless you are comfortable sending them to the external API service.
scripts/config.py:48API Key Persisted in a Plaintext Environment File Without Enforced Access Controls
The documented purpose is literature search, but the skill also instructs the agent to collect and persist an API key via local configuration for an external service. This behavior mismatch can mislead users and reviewers about the true security-sensitive actions performed, reducing informed consent around secret handling and privileged configuration changes.
The documented purpose is literature search, but the skill also instructs the agent to collect and persist an API key via local configuration for an external service. This behavior mismatch can mislead users and reviewers about the true security-sensitive actions performed, reducing informed consent around secret handling and privileged configuration changes.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
model_config = SettingsConfigDict(
env_prefix="XBY_GAOKAO_",
env_file=".env",
env_file_encoding="utf-8",
extra="ignore",
)
This code explicitly opens and parses the .env file to extract an API key, creating an additional credential-reading path outside the settings framework. While likely intended for convenience, duplicative manual secret parsing expands the secret exposure surface and can normalize direct credential handling inside application logic.
default_year: int = 2025
def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")
The call to read_text loads the entire .env file contents into memory for manual parsing, unnecessarily broadening access to all secrets in that file rather than only the needed key. In a skill context, this is more concerning because the advertised functionality is literature search, not local credential file inspection or secret management.
def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")
for line in content.splitlines():
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if line.startswith("XBY_APIKEY="):
self.api_key = line.split("=", 1)[1].strip()
break
# 如果环境变量有值，覆盖 .env 的值
env_val = os.getenv("XBY_APIKEY", "")
if env_val:
self.api_key = env_val
This function is dedicated to writing an API key into a local .env file, which materially increases the risk of plaintext secret persistence, accidental disclosure, and misuse by downstream tools or users with filesystem access. In the context of a literature-search skill, persistent credential storage is ancillary functionality and therefore less expected, making the behavior more sensitive.
def save_api_key_to_env(api_key: str) -> bool:
"""将API key保存到.env文件"""
try:
env_path = Path(".env")
lines = []
if env_path.exists():
lines = env_path.read_text(encoding="utf-8").splitlines()
The skill declares no explicit tool scope or allowed-tools restrictions despite describing capabilities that touch environment variables, local file writes, and network access. In an agent setting, missing capability boundaries increases the chance of over-privileged execution, unintended data access, or misuse of sensitive operations such as persisting secrets.
The skill instructs the agent to ask the user for an API key and persist it via configuration, but does not clearly warn about storage location, retention, access controls, or the risks of writing secrets into a local .env file. This is dangerous because users may unknowingly disclose long-lived credentials that could later be exposed through logs, file access, backups, or other tools in the agent environment.
L037 的说明要求调用 scripts.tools.search_schools(...)，但整份技能文档声明的实际工具均为文献搜索相关函数，如 search_literature、get_article_details 等。这不是单纯遗漏，而是把高考/学校查询函数写进了文献搜索技能的必遵工作流，主动误导调用方对技能真实能力的理解。
The code persists an API key to a local .env file and mutates runtime credentials through helper functions, which goes beyond passive configuration loading and increases secret-handling risk. Storing credentials in plaintext without explicit user consent or storage hardening can expose the key to other local users, backups, logs, or accidental source control inclusion.
The function silently writes the supplied API key into a plaintext .env file and updates the process environment without any user-facing warning, confirmation, or indication of persistence. This can cause users or integrating agents to unintentionally store sensitive credentials on disk where they may be recovered later.
Natural-language policy violations apply to all file types, including code docstrings. Here, the user-facing documentation and operational guidance are presented in Chinese only, with no indication that the user can choose another language or that the locale restriction is intentional and justified.
The wrappers forward user-supplied keywords, identifiers, and journal names to an external API via call_api, but the tool text does not clearly disclose this outbound data transmission or any privacy implications. In an agent setting, users may reasonably assume local processing, so sensitive research topics, unpublished identifiers, or query intent could be unintentionally shared with a third-party service.
The manifest describes a '专业文献搜索工具' and enumerates search, detail retrieval, references, relation analysis, journal quality evaluation, and export. However, this function's docstring and API call implement '获取文献全文工具' and explicitly return full article content, which is materially broader than metadata/detail retrieval and changes the skill from search/analysis into content acquisition.
SQP-3 适用于所有文件中的自然语言策略问题。该技能名称、描述和全部操作说明均仅以中文给出，且没有提供语言选项、用户偏好协商或说明这是面向特定中文场景的区域性工具，因此存在强制特定语言/locale 的风险。
L348 将项目结构标为 xiaobenyang_gaokao_skill/，这与当前“文献搜索工具”的用途明显不一致。该类内联文档会让集成者误以为该技能属于高考/院校查询项目，属于文档意图与当前技能定位的直接冲突。
The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or incompatible releases into the environment.
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
The manifest does not pin requests, and the package has multiple published advisories across versions. Because the resolved installed version is unknown, consumers may inadvertently install an affected release, especially in fresh or rebuilt environments.
Using an unpinned pydantic version means builds are not deterministic and may pull in a later release with security or stability issues. In security-sensitive tooling, this increases supply-chain risk even if no immediate exploit is present in the manifest itself.
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Pydantic has known advisories in some versions, and this requirement does not constrain installs to a verified safe release. That makes the actual security posture unverifiable and may expose deployments to denial-of-service or parsing-related flaws depending on the resolved version.
The unpinned pydantic-settings requirement permits uncontrolled version drift during installation. That can expose deployments to newly introduced vulnerabilities or breaking behavior without any code change in the skill itself.
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Because pydantic-settings is not pinned, there is no assurance that installations avoid versions affected by known advisories. This creates avoidable uncertainty in a component that may process configuration and secrets-related inputs.
A minimum-only version for python-dotenv allows the package manager to install any newer release, including versions later found vulnerable. This is a common supply-chain hygiene issue that reduces reproducibility and assurance.
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
The unpinned python-dotenv dependency leaves open the possibility of installing versions impacted by known issues. Since dotenv-related libraries can interact with configuration files and local paths, unresolved version drift can increase operational risk.