Security audit

大藏经学术引用生成器

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed CBETA citation helper; the main caution is an optional login-cookie helper for one third-party Buddhist-text database.

Install this if you are comfortable with a citation tool making CBETA network lookups. Use the optional 中华大藏经定位.py helper only if you intentionally want to query fo.ancientbooks.cn with your own login cookie, and avoid storing a broad browser cookie in fo_cookie.txt unless you understand that local-file secret risk.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documentation describes capabilities to access environment variables, write files, invoke shell commands, and make network requests, but no explicit permissions are declared. This creates a least-privilege gap: an agent or platform may execute broader actions than users expect, increasing the chance of unintended data access, file modification, or external communication.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill claims it depends only on official CBETA APIs and local data, yet also documents an optional script requiring authenticated access to a third-party site. This inconsistency can mislead reviewers and users about the trust boundary, causing them to approve or run a skill with broader external dependencies than disclosed.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documented ability to read a third-party login cookie from an environment variable or local file exceeds the core purpose of generating academic citations. Handling authentication material introduces credential-exposure risk and expands the attack surface, especially in agent environments where env vars and local files may contain sensitive secrets.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The documentation presents mutually inconsistent statements about dependency scope and third-party login capability. Such contradictions are dangerous because they undermine security review, obscure actual data flows, and make it easier for privileged behavior to slip into a seemingly harmless reference skill.

Description-Behavior Mismatch

Medium

Confidence: 79% confidence
Finding: The skill advertises citation generation, but when a local JSON file is missing it automatically executes another local script. In an agent/skill environment, hidden secondary execution increases the trusted computing base and can surprise operators, especially if that helper script is modified, replaced, or not reviewed to the same standard.

Context-Inappropriate Capability

Medium

Confidence: 75% confidence
Finding: The skill invokes external subprocesses (curl and a helper script) even though its stated purpose is text/citation formatting. In a skill ecosystem this broadens capability from formatting into process execution, which increases attack surface, complicates review, and makes supply-chain or environment-manipulation issues more consequential.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: 按经文查出处.py:40