ClawHub
Back to skill

Security audit

文本转换工具

Security checks for vulnerabilities and agentic risk

Overview

The skill advertises simple text conversion but sends user text to a third-party API and stores an API key in a plaintext .env file.

Review this skill carefully before installing. Use it only if you are comfortable sending every text input to XiaoBenYang's API and storing the XBY API key in a local plaintext .env file; do not use it for secrets, private documents, source code, personal data, or regulated content.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/call_api.py:49
Finding

Unnecessary Disclosure of User Text to a Third-Party API

Content
View full analysis

Vulnerability Details

File Location: scripts/call_api.py:49-72; invoked by every wrapper in scripts/tools.py:7-157
Vulnerability Type: Unnecessary external transmission of user-provided data
Risk Level: High

Vulnerable Code

python
url = f"{settings.base_url}/api"
mcp_id = mcp_id or settings.mcp_id

api_key = get_api_key()
if not api_key:
    raise UpstreamError("API密钥未设置，请先调用 set_api_key()")

headers = {
    "XBY-APIKEY": api_key,
    "func": tool_name,
    "mcpid": mcp_id,
    "Content-Type": "application/json",
}

# data = {k: str(v) if v is not None else "" for k, v in params.items()}

t0 = time.time()
try:
    resp = self._session.post(
        url=url,
        headers=headers,
        data=json.dumps(params),
        timeout=settings.timeout_seconds,
    )

A representative wrapper in scripts/tools.py passes user text directly into this request:

python
arguments = {
    "text": text
}

return call_api("1777316659708931", "lowercase", arguments)

Technical Analysis

Every advertised operation sends the complete user-supplied text and an API credential to https://mcp.xiaobenyang.com/api. This includes lowercase conversion, uppercase conversion, reversal, palindrome checking, word and character counting, trimming, and capitalization.

These deterministic operations can be performed locally without network access. Delegating them to a third party unnecessarily expands the data-access boundary and may expose confidential text, personal information, source code, authentication material, or other sensitive content. The documentation states that an API is used, but it does not provide a clear privacy warning, retention policy, or per-request consent mechanism.

The endpoint uses HTTPS, so the issue is not plaintext network transport. The issue is disclosure to an external service beyond the minimum privileges and data access legitimately req ...[truncated 1000 chars]

Remediation
View remediation

Remediation Suggestions

  • Implement all deterministic text transformations locally and remove the remote API dependency for these operations.
  • If remote processing is genuinely required, disclose the exact destination and categories of transmitted data before invocation.
  • Obtain explicit user consent before transmitting content externally.
  • Add validation that detects and rejects likely credentials, private keys, tokens, and other high-risk secrets.
  • Document the external provider's retention, deletion, access-control, and privacy policies.
  • Minimize transmitted fields and avoid sending any information that is not essential to the selected operation.
  • Provide a local-only mode and make it the secure default.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/config.py:43
Finding

API Key Persisted in a Predictable Plaintext File Without Permission Hardening

Content
View full analysis

Vulnerability Details

File Location: scripts/config.py:43-65
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

Vulnerable Code

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
        found = False
        new_lines = []
        for line in lines:
            if line.startswith("XBY_APIKEY="):
                new_lines.append(f"XBY_APIKEY={api_key}")
                found = True
            else:
                new_lines.append(line)
        if not found:
            new_lines.append(f"XBY_APIKEY={api_key}")
        env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8")
        os.environ["XBY_APIKEY"] = api_key
        return True
    except Exception as e:
        print(f"保存API key失败: {e}")
        return False

Technical Analysis

The Skill writes a user-provided API key directly into .env in the current working directory. The file location is predictable, and the implementation does not explicitly create or enforce owner-only file permissions. It also does not verify file ownership, reject symbolic links, use atomic replacement, or prevent the credential file from being committed to version control.

The effective permissions may be influenced by the process umask and preexisting file state. Consequently, confidentiality is not guaranteed by the implementation itself. Writing through a predictable path also creates a potential symbolic-link or unintended-file-overwrite concern when the working directory is controlled by another party.

Attack Path

  1. The Skill asks the user for an API key.
  2. The user supplies the credential to set_api_key().
  3. save_api_key_to_env() writes the key as plaintext to .env.
  4. A lo ...[truncated 889 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer an operating-system credential store, secret manager, or session-only credential injection instead of persistent plaintext storage.
  • If file storage is unavoidable, create the credential file atomically with owner-only permissions such as 0600.
  • Verify that the file is owned by the expected user and is not a symbolic link before reading or writing it.
  • Resolve the storage location to a dedicated, private application configuration directory rather than the current working directory.
  • Add .env to version-control ignore rules and provide repository-level secret scanning.
  • Avoid retaining the key longer than necessary and support explicit credential deletion and rotation.
  • Do not print or include the credential in exceptions, logs, or returned API data.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Dependencies Are Not Reproducibly Pinned or Hash-Verified

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: Unbounded dependency resolution
Risk Level: Low

Vulnerable Code

text
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Technical Analysis

Every dependency is specified with only a lower version bound. Future installations can therefore resolve newer releases that were not reviewed with this project. No lock file or package hashes are supplied to ensure that installations reproduce a known dependency set.

The reviewed package names are established packages, and the audit found no direct evidence that any listed dependency is currently malicious. The risk arises from uncontrolled future resolution, compromised package releases, incompatible major versions, or changes in transitive dependencies.

Attack Path

  1. An operator installs the project dependencies at a later time.
  2. The package resolver selects the newest releases satisfying the lower-bound constraints.
  3. A compromised, unexpectedly changed, or incompatible direct or transitive release is downloaded.
  4. Package installation or import executes code from that release in the installer or application context.
  5. The dependency receives the filesystem, network, environment-variable, and process privileges available to the Skill.

Impact Assessment

A compromised dependency could execute code with the same operating-system privileges as the process installing or running the Skill. This could expose the stored API key, user text, accessible files, and network resources. However, this is a supply-chain hardening weakness rather than evidence of an existing malicious package in the reviewed project.

Remediation
View remediation

Remediation Suggestions

  • Replace open-ended lower bounds with reviewed, exact versions in a generated lock file.
  • Generate and verify cryptographic hashes for all direct and transitive packages.
  • Install with hash enforcement, such as pip install --require-hashes.
  • Separate human-maintained dependency constraints from a fully resolved deployment lock file.
  • Use automated vulnerability and dependency-update tooling, but require review and testing before accepting updates.
  • Restrict package installation to trusted indexes and disable unintended extra package sources.
  • Rebuild the lock file through a controlled process whenever dependencies are upgraded.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (40)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to perform basic text operations, but the documentation also describes reading environment variables, writing .env files, persisting API keys, and managing remote service configuration. Hidden credential storage and configuration management are materially different from the advertised function and create confidentiality and integrity risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to perform basic text operations, but the documentation also describes reading environment variables, writing .env files, persisting API keys, and managing remote service configuration. Hidden credential storage and configuration management are materially different from the advertised function and create confidentiality and integrity risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

A skill advertised as local text manipulation should not unexpectedly depend on a remote API and secret configuration. This discrepancy undermines informed consent and can facilitate covert data exfiltration or credential harvesting through misleading UX.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document pivots from a text tool to instructions for collecting an API key and calling an external gaokao/school-query service. In this context, the mismatch is especially dangerous because users may provide credentials under false assumptions about the skill's purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The example invocation references a school-search function rather than any listed text transformation function, indicating copy-paste residue or concealed alternate behavior. This strongly suggests the skill may invoke unrelated remote operations that users and hosts are not expecting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This text utility initializes an HTTP session, performs outbound network requests, and uses an API key, none of which are necessary for simple case conversion, reversal, or palindrome checks. In the context of a text-processing skill, hidden network and credential use is especially risky because arbitrary input text may be transmitted to a third party and the skill can serve as a covert bridge to external services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is described as a local text-conversion utility, but this file implements a generic remote API invocation mechanism that can call arbitrary MCP tools by passing user-controlled mcp_id, tool_name, and params to an upstream service. This capability materially exceeds the stated purpose, creates hidden data exfiltration and remote-action risk, and makes the skill dangerous in contexts where users expect only local text processing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements remote service configuration and API key handling, which is materially inconsistent with a skill described as a local text transformation tool. This mismatch increases the risk of hidden data flow to an external service and secret handling beyond user expectations, especially because the code initializes a base URL, MCP ID, and credential loading logic.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python
model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The code forcefully reads a specific API key from .env during initialization, bypassing normal scoped settings behavior and increasing the likelihood of unintended secret ingestion. In the context of a text transformation skill, this expands sensitive-data handling without clear necessity and may silently load credentials users did not expect this skill to access.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Reading the entire .env file directly to extract an API key introduces unnecessary secret-processing logic and broadens the code path touching credential material. This increases the chance of mishandling, accidental logging, or future extension into more invasive credential access than the skill description justifies.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python
def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python
if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill includes persistent API key storage in a .env file for functionality that does not appear necessary for text conversion. Persisting credentials locally expands the attack surface by leaving secrets on disk and creates a covert capability inconsistent with the declared purpose of the skill.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This function persists an API key to a local .env file in plaintext, creating durable credential exposure on disk. In a skill that claims to perform text transformations, this capability is disproportionate and makes the hidden secret-handling behavior more suspicious and dangerous.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares itself as a simple text transformation utility, yet the documentation indicates capabilities consistent with environment access, file persistence, and external network use, without any explicit tool-scope restrictions. This increases the attack surface and prevents users or hosts from understanding and constraining what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Requesting an API key for a trivial text conversion skill is contextually anomalous and should be treated as suspicious. Even if not overtly malicious, it creates an unnecessary opportunity to collect secrets and expands risk far beyond the claimed functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

This skill file presents core routing behavior and tool-selection criteria in English while the rest of the document is written in Chinese, but it does not state that users may choose their preferred language. That creates an implicit language policy/locale constraint in the skill behavior without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code contains natural-language strings such as the class docstring and raised error message entirely in Chinese, with no indication that the skill is intentionally region-specific or that users can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Settings 类的文档字符串写明“"小笨羊高考Skill配置"”，而本技能 manifest 名称与描述均指向“文本转换工具”。这不是简单的信息缺失，而是文档直接表明该代码服务于另一类技能/业务域，反映出技能意图与实现来源不一致。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code writes the API key to .env in plaintext without any visible user-facing notice or consent flow. This is dangerous because users may unknowingly leave credentials on disk where they can be exposed through backups, repository mistakes, local compromise, or debugging artifacts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is presented as a simple local text-conversion utility, but the implementation routes user-provided text to an external API via call_api. This creates an unexpected data-exfiltration path for potentially sensitive text and violates user expectations about local-only processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

For trivial operations like lowercase, reverse, trim, and word counting, introducing remote API calls is unnecessary and broadens the attack surface beyond the declared purpose of the skill. Any text passed to these helpers is exposed to external processing, creating privacy, compliance, and trust risks disproportionate to the feature set.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The lowercase helper sends arbitrary user text to a remote API without any user-facing disclosure that content leaves the local environment. Even seemingly harmless text utilities may be used on secrets, prompts, personal data, or proprietary material, so silent transmission creates a real confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The uppercase helper forwards input text to an external API even though the operation can be completed entirely locally. This hidden network transfer can expose sensitive content and undermines the principle of least astonishment for users of a basic text utility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The reverse helper transmits user text externally for a trivial string manipulation task. Because users are given no indication that text is being sent off-host, confidential or regulated data could be disclosed unexpectedly.

Content

No source excerpt is available for this finding.