卡路里追踪服务

• Outcome: Review
• Latest audit: Jul 3, 2026 · 5:16 PM UTC
• Version: 1.0.1

Overview

This appears to be a calorie-tracking skill, but it handles API keys and sends data to an external service while retaining mismatched Gaokao/school-search artifacts that users should review before installing.

Install only if you trust the XiaoBenYang API provider and are comfortable giving it meal and calorie-tracking data plus an API key. Treat the plaintext .env key as sensitive, avoid using this in shared workspaces, and ask the publisher to remove the Gaokao/school-search remnants, document the exact backend and data handling, sanitize upstream responses, and lock dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documentation describes behaviors that require environment access, file read/write, and network use, yet no permissions are declared. This creates a transparency and consent gap: hosts or users may not understand that the skill will request API keys, persist them locally, and make outbound requests, which increases the risk of secret handling and unintended data exposure.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill claims to be a calorie tracker, but the example tool call and project path reference a gaokao school-search skill. This mismatch is a supply-chain integrity problem because it suggests copy-paste residue, misrouting, or the possibility that the agent may invoke unintended tools or handle data for a different service than advertised.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The configuration is for an unrelated external service ('小笨羊高考') despite the skill being ներկայացված as a calorie tracker. This mismatch strongly suggests hidden functionality and creates risk that users or operators may unknowingly supply credentials to a different backend than expected.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file implements API key loading, overriding, and persistence for an external service without clear justification from the advertised skill purpose. In the context of a mislabeled skill, secret-handling code increases the likelihood of credential collection or unauthorized third-party service access.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The docstring explicitly identifies the module as configuration for a different skill ('小笨羊高考Skill配置'), directly contradicting the published metadata. Such contradiction is a strong indicator of repurposed or deceptive code and undermines trust in the skill's stated function.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions explicitly say to directly display `result['raw']` API response data to the user, but there is no warning or filtering guidance. Raw upstream responses can contain sensitive fields, internal metadata, debug information, or unsafe content that should not be echoed back verbatim.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function writes the API key directly to a local .env file without user-facing warning, consent flow, or protection controls. This can expose secrets through local filesystem access, accidental commits, backups, or shared environments.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 88% confidence
• Finding: The code forcibly reads a specific API key from .env outside the normal settings abstraction, targeting a secret for an unrelated external service. In the context of a mislabeled skill, this explicit secret extraction is suspicious and may facilitate covert credential use.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 88% confidence
• Finding: Constructing a direct path to .env and reading its contents enables targeted access to locally stored secrets. Given the discrepancy between the advertised calorie-tracking purpose and the actual external service identifiers, this access is more dangerous because it appears unrelated to user expectations.

Credential Access

High

• Category: Privilege Escalation

Content

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

• Confidence: 90% confidence
• Finding: The code explicitly looks up XBY_APIKEY from the environment and uses it to override the loaded value, demonstrating intentional credential acquisition for an unrelated service. In a deceptive skill context, this can enable unauthorized backend access while concealing the true destination from users.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 86% confidence
• Finding: This function is dedicated to storing an API key in .env, which increases the exposure window for credentials through plaintext local storage. While secret persistence can be legitimate, doing so in a mislabeled skill handling an unrelated service key materially raises risk.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 83% confidence
• Finding: The set_api_key entry point makes secret persistence a first-class feature for an unrelated external service. In this context, it normalizes collecting and storing credentials that users would not expect a calorie tracker to need.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), which permits installation of different future versions and makes builds non-reproducible. This increases supply-chain risk because a later incompatible or compromised release could be pulled into deployments without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: Using `pydantic>=2.7.0` leaves the environment open to silently consuming newer versions, reducing reproducibility and increasing exposure to supply-chain regressions or malicious package releases. While not an exploit by itself, it is a genuine security hygiene weakness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: `pydantic-settings>=2.2.0` is unpinned, so future installs may resolve to unexpected versions. This weakens build integrity and can introduce unreviewed code or breaking behavior into the skill's runtime.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: `python-dotenv>=1.0.1` is not pinned, allowing uncontrolled future versions during installation. In a service that likely handles configuration and secrets via environment files, this increases supply-chain exposure and undermines deterministic deployments.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The finding indicates `requests` 2.31.0 has published advisories, including credential leakage via malicious URLs and session verification issues. Because this skill is an MCP server that likely makes outbound HTTP requests for food search or integrations, a vulnerable HTTP client can be relevant if attacker-controlled URLs, redirects, or sessions are involved.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: `python-dotenv` 1.0.1 is flagged for a symlink-following arbitrary file overwrite issue in `set_key`. If this service ever writes `.env` values programmatically, especially in a writable or attacker-influenced filesystem context, it could overwrite unintended files; however, impact depends on whether that API is actually used.

Static analysis

No suspicious patterns detected.