Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-model API gateway with local tracking and optional report webhooks; I found no hidden exfiltration, destructive behavior, or system persistence.
Install this only if you intend to send prompts and selected media/text inputs to configured model providers. Prefer environment variables for API keys, protect the local ~/.cn-model-gateway databases, avoid untrusted webhook URLs, and remember that batch tasks may store submitted prompts and results locally.
The skill description emphasizes an MCP gateway, but it also advertises active webhook pushing via a user-supplied external URL and broader non-MCP operational behavior. Undeclared or underemphasized outbound transmission paths are security-relevant because they can be used to exfiltrate metadata, reports, or derived usage information to arbitrary endpoints.
The skill description emphasizes an MCP gateway, but it also advertises active webhook pushing via a user-supplied external URL and broader non-MCP operational behavior. Undeclared or underemphasized outbound transmission paths are security-relevant because they can be used to exfiltrate metadata, reports, or derived usage information to arbitrary endpoints.
The skill description emphasizes an MCP gateway, but it also advertises active webhook pushing via a user-supplied external URL and broader non-MCP operational behavior. Undeclared or underemphasized outbound transmission paths are security-relevant because they can be used to exfiltrate metadata, reports, or derived usage information to arbitrary endpoints.
The skill description emphasizes an MCP gateway, but it also advertises active webhook pushing via a user-supplied external URL and broader non-MCP operational behavior. Undeclared or underemphasized outbound transmission paths are security-relevant because they can be used to exfiltrate metadata, reports, or derived usage information to arbitrary endpoints.
The skill description emphasizes an MCP gateway, but it also advertises active webhook pushing via a user-supplied external URL and broader non-MCP operational behavior. Undeclared or underemphasized outbound transmission paths are security-relevant because they can be used to exfiltrate metadata, reports, or derived usage information to arbitrary endpoints.
The skill description emphasizes an MCP gateway, but it also advertises active webhook pushing via a user-supplied external URL and broader non-MCP operational behavior. Undeclared or underemphasized outbound transmission paths are security-relevant because they can be used to exfiltrate metadata, reports, or derived usage information to arbitrary endpoints.
The skill description emphasizes an MCP gateway, but it also advertises active webhook pushing via a user-supplied external URL and broader non-MCP operational behavior. Undeclared or underemphasized outbound transmission paths are security-relevant because they can be used to exfiltrate metadata, reports, or derived usage information to arbitrary endpoints.
The skill documents capabilities that require environment access, file read/write, and outbound network access, but it does not declare any explicit tool scope or permission boundary. In an agent ecosystem, this weakens least-privilege controls and can cause hosts to grant broader access than intended, especially because the skill also handles API keys, local files, and webhook/network operations.
The document claims the skill 'only' acts as a standard MCP gateway, yet it also includes benchmarking, price tracking, anomaly radar, scheduled reporting, and non-MCP framework adapters. This kind of scope understatement can mislead users about operational behavior, trust boundaries, and the presence of cost-bearing or outbound features, reducing informed consent and safe deployment decisions.
The text says '所有错误信息均为中文', which is a natural-language policy constraint affecting user-facing output language. The file does not indicate any user choice, locale detection, or opt-in mechanism for non-Chinese users.
The code claims all requests are made over HTTPS, but http_post_json does not validate the scheme of the supplied URL before issuing the request. If an attacker or unsafe configuration can influence provider endpoints, the gateway could send prompts, API keys, or model outputs over unencrypted HTTP or even to unexpected local/internal endpoints, undermining confidentiality and enabling SSRF-style misuse.
The code claims all requests are made over HTTPS, but http_post_json does not validate the scheme of the supplied URL before issuing the request. If an attacker or unsafe configuration can influence provider endpoints, the gateway could send prompts, API keys, or model outputs over unencrypted HTTP or even to unexpected local/internal endpoints, undermining confidentiality and enabling SSRF-style misuse.
This code explicitly mandates Chinese for adapter errors and uses Chinese-only natural-language strings in module documentation and exception messages. That is a language policy constraint embedded in the skill without any indication of user choice or documented justification for a Chinese-only locale.
The code builds the OAuth2 token URL with the AK/SK placed directly in the query string. Even over HTTPS, credentials in URLs are more likely to be exposed through logs, proxies, monitoring systems, exception traces, browser/debug tooling, or upstream infrastructure than credentials sent in a POST body or Authorization header. In a gateway skill that brokers access to multiple model providers, leakage of these long-lived provider credentials could let an attacker obtain access tokens and impersonate the service against the ERNIE API.
The module docstring and user-facing error/help messages are written only in Chinese, including installation guidance and credential setup instructions. This imposes a language choice on users without opt-in or documented locale scope, which matches the language/locale policy violation category.
This code file contains user-facing natural-language documentation entirely in Chinese, including the module description and safety notes, with no indication that another language is supported or that Chinese is optional. Under the policy rule for language/locale constraints, this can be treated as forcing a specific language without explicit user opt-in or documented justification.
The natural-language instructions, usage notes, and CLI descriptions in this file are exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented justification is a locale/language policy concern.
The file’s user-facing natural-language content in docstrings and comments is entirely in Chinese, with no indication that another language is supported or that the locale is intentionally limited. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless clearly documented and justified.
The module is described as a local billing/usage tracker, but it also creates an arena_sessions table that persists full prompts. In an agent gateway, prompts commonly contain sensitive user data, secrets, internal documents, or regulated content, so storing them in plaintext SQLite expands the data-retention and privacy exposure beyond the documented purpose.
log_arena_vote writes the full prompt field directly into local SQLite, and this code provides no minimization, redaction, retention warning, or consent mechanism. Because this gateway services many model providers and agent frameworks, prompts are likely to contain highly sensitive conversational and business data, making local plaintext storage a meaningful confidentiality and compliance risk.
This file presents its natural-language documentation and command-line output exclusively in Chinese, including the module docstring and status messages. Per the policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified, and no such justification or opt-in appears here.
The health-check command prints all status and conclusion messages in Chinese only. This enforces a locale choice on users with no alternative or configuration mechanism, which matches the language-policy violation criteria.
The CLI's interactive prompts, status messages, and argparse help text are consistently hard-coded in Chinese throughout the file. This imposes a specific language choice on all users without offering a locale option or documenting that the tool is intentionally limited to a Chinese-only audience.
The manifest frames this skill as a standard MCP protocol gateway for unified model access, with reporting as an internal health/monitoring feature. This code additionally transmits generated report content to any user-supplied webhook URL, introducing a general outbound data delivery capability that is not necessary for basic gateway operation.
When --webhook is provided, the program sends the report path and up to 5000 bytes of HTML report content to an arbitrary URL without any explicit warning, confirmation, redaction, or trust boundary checks. In this gateway context, health reports may reveal provider inventory, status, usage patterns, internal paths, or operational metadata, creating an avoidable data exfiltration channel if a user pastes an untrusted webhook URL or automation is misconfigured.
