八字计算器

• Outcome: Pass
• Latest audit: Jul 2, 2026 · 11:24 PM UTC
• Version: 1.0.1

Overview

This skill appears to match its stated Bazi/calendar API purpose, but users should know it stores a required API key locally and sends inputs to a third-party service.

Install only if you are comfortable giving this skill a Xiaobenyang API key and sending Bazi/calendar inputs, such as birth time and gender, to that service. Treat the .env file as sensitive because it stores the API key in plaintext; remove or rotate the key if used on a shared machine, and prefer a pinned dependency set for production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to read configuration state, ask for a secret, persist it locally, and call remote APIs, but the skill does not declare corresponding permissions or provide transparency to the user. Undeclared env/file/network capabilities reduce auditability and can lead to unexpected secret handling and outbound data transfer in a context where users may not realize local storage and network use are occurring.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose says the skill is an AI 八字 calculator for personality/fate analysis, but the documented behavior also includes Chinese calendar lookup, reverse lookup of Gregorian times from 八字, and persistent API key storage. This mismatch is dangerous because it weakens informed consent: users may disclose sensitive birth data or API secrets without understanding the full scope of collection, storage, and external processing.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The documentation contains artifacts from a different skill domain, including a gaokao project reference and a search_schools example, indicating copy-paste reuse and poor maintenance hygiene. In security terms this increases the chance that the agent invokes the wrong tool pattern, mishandles parameters, or conceals unrelated capabilities under misleading instructions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The code persists an API key into a local .env file, creating long-lived credential storage on disk. For a skill presented as a 八字 calculator, local credential persistence is broader than the stated functionality and increases exposure through accidental checkout, backup leakage, weak file permissions, or reuse by other local processes.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill can modify both the local .env file and process environment variables to manage credentials, which exceeds what users would reasonably expect from a fortune/analysis calculator. This broadens the blast radius of a compromised or buggy skill because it can alter local configuration state and silently persist sensitive material.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill requires collecting a user API key and explicitly saving it into `.env`, yet the description lacks a clear privacy/security warning about local secret storage, retention, and who can access that file. This is dangerous because users may provide a credential without understanding persistence, reuse, or exposure risks on shared systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Writing an API key to .env without a clear warning or confirmation can surprise users and cause secret retention on disk they did not intend. This is dangerous because users may assume the key is only used transiently, while the implementation silently creates a persistent credential artifact.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 84% confidence
• Finding: The code explicitly reads .env and extracts XBY_APIKEY outside the standard settings flow, creating custom credential access logic. In the context of a 八字 calculator, this is more suspicious because the skill goes beyond consuming a provided secret and actively searches local files for credentials.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 84% confidence
• Finding: Checking for and opening the local .env file as part of post-initialization contributes to explicit credential access behavior. This increases risk of unintended secret consumption from local developer files and is harder for users to notice than externally supplied configuration.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 88% confidence
• Finding: This function is dedicated to saving an API key to .env, which means the skill intentionally creates and updates a local plain-text secret store. In this skill context, that capability is unnecessary enough to elevate concern, because it can persist credentials beyond the user's awareness and outside normal secret-management controls.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 86% confidence
• Finding: The set_api_key flow explicitly persists credentials as part of normal operation, coupling skill use with long-term local secret storage. This is risky because a non-administrative end-user feature now modifies local secret state in a way that can outlive the session and be exposed by file leakage or later compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only, which allows future builds to resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking releases through the supply chain, even if the current minimum version itself is not malicious.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: Using an unpinned version for pydantic makes installations non-reproducible and increases exposure to unexpected security regressions or incompatible upstream changes. In dependency management, this is a real supply-chain hardening weakness, though typically low severity by itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The pydantic-settings package is also unpinned, so the deployed environment may vary across installs and inherit newly introduced vulnerabilities or behavior changes. This is a genuine dependency hygiene issue rather than an immediate exploit path.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: An unpinned python-dotenv dependency permits arbitrary newer releases to be installed, which undermines deterministic builds and may pull in insecure versions. In this skill context, it is a low-risk but valid supply-chain exposure.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The requirements allow requests>=2.31.0, and the static finding highlights that version 2.31.0 has published advisories. Because the dependency is not constrained away from the vulnerable release, installations may resolve to an affected version, creating risk around credential leakage, request verification flaws, or insecure temporary file handling depending on how the library is used.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The requirements allow python-dotenv>=1.0.1, and the cited advisory indicates version 1.0.1 is vulnerable. If the skill uses python-dotenv functions such as set_key on attacker-influenced paths, this could enable unsafe file overwrite behavior; in the absence of code usage here, the package-level risk is real but context-limited.

Static analysis

No suspicious patterns detected.