智能搜索工具集

• Outcome: Review
• Latest audit: Jul 3, 2026 · 12:55 PM UTC
• Version: 1.0.1

Overview

This search skill does not look malicious, but it should be reviewed because it stores an API key locally and contains inconsistent admissions-related instructions.

Install only if you are comfortable giving XiaoBenYang an API key and sending search terms to its backend and downstream search sites. Avoid sensitive internal queries, check that .env will not be committed or shared, and consider removing the stale gaokao references and pinning dependencies before broad use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation instructs behavior that implies access to environment variables, local file reads/writes, and network operations, but no permissions are declared to make those capabilities explicit or reviewable. This reduces transparency and can lead users or hosts to approve a seemingly simple search skill that actually handles secrets and performs broader side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is a technical search toolkit, but the described behavior includes persisting API keys, using an unrelated gaokao-labeled configuration, and relying on a third-party backend with fixed remote identifiers. This mismatch is dangerous because it obscures what the skill really does, increasing the chance that users expose credentials or queries to an unexpected service under false assumptions.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file presents a technical search skill, but the embedded workflow and project structure reference an unrelated gaokao/admissions skill. Such identity inconsistency is a strong trust and supply-chain risk signal because it suggests copied or repurposed instructions that may cause the agent to invoke unintended functions or services.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The workflow example tells the agent to call an unrelated `search_schools` function, which contradicts the advertised search toolkit. This can misroute user intent, trigger the wrong backend behavior, and indicates the skill may be repurposed from a different domain without proper review.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documented project structure names an unrelated `xiaobenyang_gaokao_skill` package, contradicting the claimed technical search identity. This inconsistency weakens trust, complicates review, and may hide accidental or intentional coupling to unrelated code and services.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code persists a supplied API key into a local .env file and also updates process environment state, which exceeds the stated search-tool behavior and introduces credential storage risk. If the workspace is shared, committed to version control, or readable by other local users/processes, the secret can be exposed without the user clearly understanding it will be persisted.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to collect and save an API key but provides no warning about where the credential is stored, how long it persists, or who can access it. That creates a credential-handling risk, especially if keys are written to `.env` or environment state on shared systems.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill directs the agent to fetch generated search URLs from multiple third-party services without warning that user queries will be transmitted externally. This can expose sensitive prompts, proprietary terms, or internal identifiers to external platforms unexpectedly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function writes the API key to .env silently, without any user-facing notice that the credential will be stored on disk. This increases the chance of accidental long-term exposure through backups, shared folders, logs, or source control, especially because the skill is described as a search tool rather than a credential-managing component.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), which permits uncontrolled upgrades to future releases. This weakens build reproducibility and can introduce vulnerable or incompatible versions through normal dependency resolution or supply-chain compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: `pydantic>=2.7.0` is unpinned, so installations may resolve to different versions over time. That increases supply-chain risk and makes it harder to guarantee that tested and deployed environments use the same, non-vulnerable release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: `pydantic-settings>=2.2.0` allows any newer version, which reduces reproducibility and can silently introduce security regressions or breaking changes. In an agent skill that may be deployed in varied environments, this makes dependency trust weaker.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: `python-dotenv>=1.0.1` is also unpinned, allowing future versions to be installed without explicit review. This creates a software supply-chain exposure and undermines deterministic deployments.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The requirement permits `requests` version 2.31.0, which is associated with multiple advisories, including credential leakage via malicious URLs and request verification issues in some session flows. Because this skill is a search/networking tool and likely makes outbound HTTP requests, use of a vulnerable `requests` release is more relevant than in a non-networked package.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The requirement allows `python-dotenv` 1.0.1, which is reported as vulnerable to symlink-following file overwrite in `set_key`. This is only exploitable if the skill or its surrounding tooling uses `set_key` on attacker-influenced paths, so the practical risk from this file alone is limited but still real.

Static analysis

No suspicious patterns detected.