中国农历查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a disclosed lunar-date API client, but it needs Review because its bearer token can be sent to an environment-selected server and it includes broader Huangli search/filter behavior than the narrow conversion framing suggests.

Install only if you trust this publisher and the nongli.skill.4glz.com service with your HUANGLI_TOKEN. Leave HUANGLI_BASE unset or set it only to the official HTTPS API host, avoid very large batch ranges, and prefer a version that validates the API origin, caps batch size, and clearly states whether Huangli activity search is in scope.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: toolkit.py:31

Finding

Bearer Token Can Be Transmitted to an Arbitrary Network Destination

Content

View full analysis

Remediation

View remediation

str: parsed = urlsplit(raw_base.rstrip("/")) if parsed.scheme != "https": raise SystemExit("Error: HUANGLI_BASE must use HTTPS") if parsed.hostname not in ALLOWED_HOSTS: raise SystemExit("Error: HUANGLI_BASE host is not allowed") if parsed.username or parsed.password or parsed.fragment: raise SystemExit("Error: invalid HUANGLI_BASE") if parsed.port not in (None, 443): raise SystemExit("Error: unexpected HUANGLI_BASE port") return raw_base.rstrip("/") ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: toolkit.py:69

Finding

Unbounded Batch Date Ranges Permit Resource and API Quota Exhaustion

Content

View full analysis

end: raise SystemExit("Error: start date is after end date") dates = make_dates(start, end) results, requested, missing, quota = [], [], [], None for part in chunked(dates, 100): payload = http_json(f"{base}/api/lunar/batch", token, method="POST", payload={"dates": part}) ``` ### Technical Analysis The `batch` command verifies only that the start date is not after the end date. It does not impose a maximum number of days. `make_dates()` eagerly materializes every date in the supplied interval as a string in a list. The command then performs one authenticated API request for every 100 dates and accumulates response data into additional lists. An excessively broad range can therefore cause: - High memory consumption from the complete date list and accumulated responses. - Excessive execution time. - A large number of authenticated outbound requests. - API quota exhaustion. - Increased remote service load. The `search` command restricts dates to 2026–2035, but the `batch` command has no corresponding restriction. Network batching in groups of 100 reduces request size but does not cap total work. ### Attack Path 1. An attacker or untrusted caller supplies a very broad valid date range: ```bash python3 toolkit.py batch 0001-01-01 9999-12-31 ``` 2. `make_dates()` iterates over the entire range and allocates a string for each date. 3. The program retains the complete list in memory. 4. The program ...[truncated 784 chars]

Remediation

View remediation

MAX_BATCH_DAYS: raise SystemExit( f"Error: batch range exceeds the {MAX_BATCH_DAYS}-day limit" ) ``` The limit should be enforced before calling `make_dates()`. For stronger protection, replace `make_dates()` with an iterator that yields bounded chunks directly. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tainted flow: 'req' from os.environ.get (line 45, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · toolkit.py (reported line 46)May include surrounding context.

python

data = json.dumps(payload).encode("utf-8")
        headers["Content-Type"] = "application/json"
    req = urllib.request.Request(url, method=method, data=data, headers=headers)
    with urllib.request.urlopen(req) as resp:
        return json.loads(resp.read())

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is a narrow date-conversion skill, but the detected behavior includes broader search, batch querying, and authenticated remote API access beyond what a user may reasonably infer from the description. This mismatch is dangerous because users and reviewers may approve the skill under a narrower trust assumption, while the actual capability surface includes data exfiltration paths and more expansive remote operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module advertises itself as a unified Huangli toolkit, directly contradicting the manifest's explicit non-Huangli positioning. This deceptive or inconsistent packaging increases the chance that users, orchestrators, or reviewers invoke a capability they did not intend to permit, undermining trust boundaries and security review assumptions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code implements Huangli-oriented activity filtering and keyword search despite the manifest stating the skill is only for lunar date conversion and should defer Huangli/jixiong use cases elsewhere. This capability mismatch can bypass policy or routing expectations, causing the wrong skill to answer broader divination/activity-selection requests and potentially exposing unauthorized functionality behind a misleading description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares access to environment variables and outbound network use, but does not explicitly scope or constrain tool permissions. In an agent setting, missing permission declarations weaken reviewability and can allow broader-than-expected access to secrets and remote services, especially since the skill requires a bearer token and supports a base-URL override.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes this skill as focused on Gregorian/Lunar date conversion and related lunar date queries. In this file, the recommended strategy includes a search mode for keyword-based cross-date retrieval, but the documented API modes above only list GET /api/lunar/date/{YYYY-MM-DD} and POST /api/lunar/batch, creating a documentation-level contradiction about what the skill supports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill classifies and emits domain values using Chinese-only literals such as constellations, lunar-day names, and Ganzhi notation, and the CLI does not provide any opt-in or alternative locale handling. This creates a natural-language locale constraint that is implicit rather than user-selectable or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill’s stated purpose is a focused date-conversion/query utility, but the implementation depends on an external tokenized web service via HUANGLI_TOKEN. Accessing environment-based credentials and a remote authenticated API is not justified by the manifest’s narrow local-seeming conversion/query description, especially when the manifest does not disclose this dependency.

Content

No source excerpt is available for this finding.