Almanac / Huangli Inquiry - 黄历查询

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:55 AM UTC
• Version: 1.0.4

Overview

This skill does what it claims: it looks up Chinese almanac information for a date using JisuAPI, with modest privacy and API-key handling caveats.

Install only if you are comfortable using JisuAPI for Huangli lookups. Use a restricted JisuAPI key with low quota where possible, be aware that requested dates and the appkey are sent to JisuAPI, and avoid invoking it for general scheduling or sensitive advice unrelated to almanac lookup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: huangli.py:38

Finding

API Credential Exposed in URL Query String

Content

View full analysis

Vulnerability Details

File Location: huangli.py, lines 38–47
Vulnerability Type: API credential exposure through URL-based authentication
Risk Level: Medium

python

params = {
    "appkey": appkey,
    "year": year,
    "month": month,
    "day": day,
}

try:
    resp = requests.get(HUANGLI_DATE_URL, params=params, timeout=10)

Technical Analysis

The appkey credential is included in the params dictionary passed to requests.get. The Requests library serializes these parameters into the URL query string, producing a request resembling:

text

https://api.jisuapi.com/huangli/date?appkey=SECRET&year=2015&month=10&day=27

HTTPS protects the request from passive interception while it is in transit, but it does not prevent the complete URL from being recorded by HTTP client diagnostics, reverse proxies, API gateways, monitoring platforms, server access logs, or error-reporting systems. Consequently, infrastructure operators or attackers who gain access to those records may recover the API credential.

Attack Path

1. The skill reads a valid credential from the JISU_API_KEY environment variable.
2. A user invokes the skill to query an almanac date.
3. The script places the credential in the request URL as the appkey query parameter.
4. A proxy, gateway, server, diagnostic facility, or monitoring system records the complete URL.
5. An attacker or unauthorized operator obtains access to the retained logs.
6. The attacker extracts the appkey value and submits requests directly to JisuAPI using the exposed credential.

Exploitation depends on access to infrastructure that records the URL; no evidence indicates that the script itself writes the URL to local logs.

Impact Assessment

A recovered key could allow an attacker to make requests with the privileges assigned to the associated JisuAPI account. The practical scope is limited to APIs and quotas e ...[truncated 251 chars]

Remediation

View remediation

Remediation Suggestions

1. If JisuAPI supports it, transmit the credential in an authorization header rather than a query parameter:

   python

   headers = {"Authorization": f"Bearer {appkey}"}
   params = {"year": year, "month": month, "day": day}
   resp = requests.get(
       HUANGLI_DATE_URL,
       headers=headers,
       params=params,
       timeout=10,
   )
   

2. If the provider requires appkey in the query string, configure clients, proxies, gateways, observability systems, and server logging to redact the appkey parameter.

3. Do not include complete request URLs in exceptions, debug output, telemetry, or audit records.

4. Use a credential restricted to only the required Huangli API and apply the lowest available request quota and source restrictions.

5. Rotate the credential periodically and immediately rotate it after suspected log exposure.

6. Restrict access to infrastructure logs, define short retention periods, and audit access to records that may contain request URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares it requires an environment variable and, by design, calls a third-party API, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates an authorization and review gap: an agent or platform may permit broader execution/network behavior than users or policy reviewers expect, increasing the chance of unintended secret access or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger description includes broad language like 'or similar almanac date-selection cases,' which leaves the activation boundary underspecified. Over-broad triggers can cause the agent to invoke the skill for loosely related date, planning, or advice queries, unnecessarily sending user data to the skill and its external backend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation says the skill uses a third-party Huangli API but does not clearly warn that the queried date will be transmitted to an external service. Even seemingly low-sensitivity inputs can reveal user plans such as weddings, moves, or ceremonies when combined with the surrounding conversation, creating a privacy and consent issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · huangli.py (reported line 14)May include surrounding context.

python

import requests


HUANGLI_DATE_URL = "https://api.jisuapi.com/huangli/date"


def query_huangli(appkey: str, req: dict):

Static analysis

No suspicious patterns detected.