Security audit

命理分析服务

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a fortune-analysis API wrapper, but it needs review because it stores an API key in plaintext and can send personal birth data and credentials to a configurable remote endpoint.

Review this skill before installing. Only use an API key you are willing to store in a local plaintext .env file, avoid placing the skill in a shared or untrusted working directory, and check that the configured endpoint is the intended XiaoBenYang service before sending birth time, gender, or location data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config.py:47
Finding: API Key Persisted in a Plaintext File Without Secure Permission or Symlink Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/call_api.py:50
Finding: Environment-Controlled API Endpoint Can Receive Credentials and Personal Data
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unbounded Dependency Constraints Permit Unreviewed Future Releases
Content: View full analysis
=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1 ``` ### Technical Analysis All dependencies use lower-bound-only version constraints. A fresh installation may therefore resolve to future major or minor releases that were not reviewed with this project. No malicious, typosquatted, or currently compromised package was established during this audit. The risk arises from unrestricted dependency drift and the absence of integrity hashes or a lock file. If a future allowed release is compromised or introduces an exploitable regression, installation can incorporate it automatically. Because imported Python packages execute local code during import and may run build or installation hooks, compromise of an accepted dependency can affect the privileges of the user or service account performing installation or execution. ### Attack Path 1. A dependency publisher account or distribution channel is compromised, or a future allowed release contains a security regression. 2. A user performs a fresh installation without a reviewed lock file or hash verification. 3. The package resolver selects the new release because it satisfies the `>=` constraint. 4. Installation hooks, imported package code, or vulnerable runtime behavior executes in the Skill environment. 5. The compromised dependency operates with the privileges of the installing or executing account. This is a supply-chain exposure rather than evidence that any listed dependency is currently malicious. ### Impact Assessment The potential impact depends on the behavior of the future dependency release. In a worst-case package compromise, code could execute with the privileges of the account installing or running the Skill, allowing access to local files, environment ...[truncated 232 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose is a fortune-analysis service, but the described behavior includes local .env access, API-key persistence, process environment mutation, and references to a different skill identity ('高考Skill'). That mismatch undermines trust boundaries and suggests users may be prompted for sensitive credentials under a misleading pretext, while the actual implementation does not clearly align with the advertised function.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.
python
model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.
python
model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.
python
default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.
python
default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: This function writes the API key into a plaintext .env file, creating persistent credential exposure on disk. In the context of a skill whose actual configured service does not match its manifest, persistent secret capture is more concerning because users may unknowingly save credentials for an unrelated backend.
Content: Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.
python
def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes capabilities to read environment variables, read/write local files, and access the network, yet it declares no explicit tool scope or permission boundaries. In this context, the model is instructed to collect and persist an API key into local configuration, so the absence of declared restrictions materially increases the chance of overbroad credential and filesystem access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This skill requests highly sensitive personal data for fortune analysis, including birth date, time, gender, and potentially location, but it provides no privacy warning, retention notice, or handling guidance. In context, these attributes are personal profile data that can be combined for identification or sensitive inference, especially when sent to a remote API.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the model to ask the user for an API key and persist it via configuration, creating a natural-language workflow for collecting and storing credentials. This is dangerous because the user may disclose secrets into a conversational channel without clear origin verification, storage guarantees, masking, or least-privilege controls.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions tell the model to directly present raw API response data to the user, which encourages broad disclosure of any fields the backend returns without filtering. In a service handling personal birth data and external API calls, this increases the risk of exposing hidden metadata, internal identifiers, error traces, or other unintended sensitive content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code performs an HTTP POST to an upstream service, sending the user-supplied params in the request body and an API key in headers. Although the code logs success and error outcomes, it does not provide a user-facing warning, confirmation, or explanatory comment/docstring that clearly discloses that user or system data will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configuration points to xiaobenyang.com and uses XBY_GAOKAO_/XBY_APIKEY identifiers, which conflicts with the advertised 命理分析 service. This mismatch is dangerous because users may provide secrets or invoke actions under false assumptions, enabling credential exfiltration or unauthorized communication with an unrelated external service.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file identifies itself as a 高考-related skill while the manifest describes a 命理分析 service, which is a meaningful description-behavior mismatch. Such inconsistencies can hide repurposed code, cause operators and users to misunderstand what service they are configuring, and increase the chance that credentials are sent to an unrelated backend.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code persists the API key directly into a local .env file without any consent flow, warning, permission hardening, or secure storage mechanism. Storing credentials in plaintext increases exposure to accidental commits, local disclosure, backup leakage, or access by other processes/users on the same system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This function collects sensitive personal data including birth date, gender, and potentially precise location coordinates, then forwards it to a remote API via call_api without any visible consent, disclosure, minimization, or local handling safeguards in this file. In a fortune-analysis context, users may not expect their personal profile and location-derived data to be transmitted off-box, creating privacy and compliance risk if the backend is third-party or logs requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This API wrapper sends birth-related personal data and fortune query parameters to an external service without any user-facing warning or consent mechanism shown in this file. Even if not directly exploitable as code execution, it creates a real privacy exposure because sensitive personal attributes are disclosed to a remote system for profiling-style analysis.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The function transmits birth date, gender, and a requested palace analysis target to an external API without visible privacy disclosure in this file. Because astrology/fortune tools inherently process personal profile data, silent remote transfer increases the risk of unauthorized sharing, sensitive inference, or regulatory noncompliance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This function forwards birth date, gender, and related metadata to a remote API to generate a Bazi chart, with no visible warning or consent flow in the file. Such data can be personally sensitive and may be retained or correlated by the external service, making undisclosed transmission a legitimate privacy vulnerability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The wrapper sends birth data and query timing information to an external API without any visible user disclosure or indication of third-party processing in this file. In the context of fortune prediction, this enables remote collection of personal profile data that could be used for tracking, inference, or secondary use beyond the user's expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This function submits personal birth information to a remote service for five-element analysis without any visible warning, consent, or privacy boundary in the file. While not an integrity issue, it is a valid privacy/security concern because sensitive personal inputs are exfiltrated to an external processor by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Multiple tool definitions hard-code the default language parameter to zh-CN, which imposes a specific locale without documenting user choice or opt-in. The policy allows locale constraints only when justified or when the user is offered a choice, neither of which is stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This tool definition sets language to zh-CN by default, which enforces a locale preference without indicating that the user can choose another language. That creates a natural-language policy issue unless the restriction is clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The default language value is zh-CN, but the skill text does not say the user may opt into another language or locale. Without user choice or documented justification, this is a locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The language parameter defaults to zh-CN here as well, establishing a mandatory locale preference in the absence of any user opt-in language selection. The file does not document this as a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This parameter table again defaults output to zh-CN without offering user language choice in the instructions. Repeated locale forcing across tools violates the stated policy unless clearly justified.
Content: No source excerpt is available for this finding.