baidu-youjia-car

• Outcome: Review
• Latest audit: Jul 21, 2026 · 5:11 AM UTC
• Version: 2.0.0

Overview

This car-pricing skill is purpose-aligned, but it needs review because it sends phone numbers to Baidu and stores or displays API keys in plaintext.

Review before installing if you are uncomfortable sharing a phone number with Baidu Youjia or storing API keys in plaintext local files. Prefer passing a key explicitly or using a secure environment variable, avoid committing the skill .env file, rotate any key that was printed in chat, and remove ~/.youjia/key.json and the package .env entry if you no longer want the key persisted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation describes capabilities to read environment variables, read and write local files such as `.env` and `~/.youjia/key.json`, and perform network requests, but it does not declare any corresponding permissions. This creates a transparency and consent problem: a host agent or user may invoke the skill without understanding that it can persist secrets locally and access external services, increasing the risk of unintended secret exposure or unauthorized side effects.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly says the SMS-based flow will persist the acquired API key to ~/.youjia/key.json and overwrite both the YOUJIA_API_KEY environment variable and the skill-local .env. That is broader than a simple query skill needs and creates credential-integrity risk: a user action intended to obtain temporary access can silently replace existing secrets and alter future behavior across sessions.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The documented capability to acquire credentials through phone number and SMS verification expands the skill beyond passive car-information lookup into account-linked credential provisioning. In context this may be intended for convenience, but it increases the attack surface by handling sensitive identifiers and authentication flows that are not necessary for answering a one-sentence automotive query.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The client can persist an API key into a package-local .env file, creating unnecessary secret storage beyond the core car-query function. This increases the chance of accidental disclosure through source control, backups, shared workspaces, or other local users/processes reading the file.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The code searches multiple local locations for credentials, including environment variables, a package .env file, and ~/.youjia/key.json. While intended for convenience, this expands secret-discovery behavior and increases the chance of unintentionally consuming sensitive credentials from places the user did not expect this skill to read.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The guide instructs persisting a user-specific API key locally and modifying active configuration state, which expands the skill from simple car-query behavior into credential management. This increases the attack surface because secrets are stored on disk and configuration is changed in ways users may not expect from the stated skill purpose.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: Overwriting the skill package's `.env` with a user-specific API key is risky because `.env` files are often broadly readable within a workspace, may be committed accidentally, and affect future executions beyond the current session. Modifying packaged configuration also breaks isolation between users and can leak or misuse one user's credential in later runs.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documented ability to overwrite the package `.env` is not required for querying automobile data and introduces persistent secret modification inside the installed skill. This can expose credentials to other processes, developers, backups, or source-control workflows and makes cross-session credential contamination more likely.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to obtain an API key through a phone-verification flow and persist it to local storage (.env and key files) without any security guidance on protecting the credential, avoiding source control exposure, or understanding where secrets are written. In an agent-skill context, this can lead to accidental secret leakage through checked-in .env files, shared home directories, logs, backups, or overly broad file permissions.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation guidance is broad enough that the skill may be invoked for many loosely related car-buying questions without clear boundaries, increasing the chance the agent uses this external integration when a simpler or safer response would suffice. In practice this can cause unnecessary API use, unintended handling of pricing or location-sensitive queries, and over-collection of user inputs during conversations about cars.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: Mandating Chinese-language guidance without checking the user's language or locale can cause the agent to present consent, setup, or error-handling instructions in a language the user may not understand. This is especially problematic here because the file instructs the agent to guide users through API key acquisition and configuration steps, so misunderstandings could lead to incorrect credential handling or failed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The markdown describes automatic persistence and overwriting of key material in several locations without a prominent warning about the security and operational consequences. This can lead to unintended credential replacement, confusion over which key is active, and accidental use of a newly obtained key in later requests without the user's informed consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script persists the supplied API key to a local file under the user's home directory without any runtime warning, consent prompt, or mention of file permission hardening. Storing credentials in plaintext increases exposure to other local users, backup systems, malware, or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: After obtaining a key, the code automatically stores it in local configuration and proceeds even though the user is not given an explicit execution-time disclosure that a secret will be written to disk. This can surprise users and creates unnecessary credential persistence risk for a token that may only be needed transiently.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The flow tells the agent to send the user's phone number to an external service immediately after collection, but does not explicitly warn that the number will be transmitted off-platform for SMS processing. Even though a terms link is shown, that is not the same as clear, specific consent for external transmission of personal data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Displaying the full newly created API key in chat exposes a live credential in plain conversation output, where it may be logged, retained in transcripts, or viewed by unintended parties. The lack of guidance to avoid sharing or to rotate the key if exposed increases the chance of unauthorized use.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to echo the full API key back to the user for both new and existing keys, creating plaintext credential exposure in conversation history. Because chat logs are commonly stored, searchable, and accessible to operators or integrations, this materially increases the risk of credential theft and downstream API abuse.

Credential Access

High

• Category: Privilege Escalation

Content

f.write(f"{k}={v}\n")
        return {"env_updated": True, "env_path": env_path}
    except Exception as e:
        # 进程内环境变量已覆盖；.env 写失败单独回报
        return {
            "env_updated": False,
            "env_path": env_path,

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

write_success = False
        write_msg = str(e)

    # 验证码流程拿到的 Key（含接口新生成的 Key）一律覆盖本地环境变量 / .env
    # 避免旧 YOUJIA_API_KEY 或旧 .env 因解析优先级挡住新 Key
    env_result = overwrite_local_env(key)

• Confidence: 94% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

write_msg = str(e)

    # 验证码流程拿到的 Key（含接口新生成的 Key）一律覆盖本地环境变量 / .env
    # 避免旧 YOUJIA_API_KEY 或旧 .env 因解析优先级挡住新 Key
    env_result = overwrite_local_env(key)

    result = {

• Confidence: 94% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

- `write_success=false` → 正常展示结果，在输出末尾附加：
  `⚠️ 本地记录保存失败，请检查文件权限：~/.youjia/key.json`
- `env_updated=false` → 在输出末尾附加：
  `⚠️ 环境变量 / .env 覆盖失败，后续查询可能仍使用旧 Key`

---

• Confidence: 91% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/apikey-fetch.md:28

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/test_all.py:388