Security audit

我的世界JAVA版本MOD搜索整合Skill

Security checks for vulnerabilities and agentic risk

Overview

This Minecraft mod-search skill is mostly coherent, but it needs review because it gives unsafe instructions for storing and passing a CurseForge API key.

Review the CurseForge key handling before installing. Do not store an API key in `references/curseforge_api.md` or pass it on the command line; prefer a protected secret store or a carefully managed environment variable. Expect the skill to contact Modrinth, CurseForge if a key is present, and mcmod.cn using your search terms.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:43
Finding: Insecure CurseForge API Key Storage and Command-Line Handling
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:43-48; supporting implementation at scripts/search_mods.py:1537, scripts/search_mods.py:1647-1648, scripts/search_mods.py:1758-1760, and scripts/search_mods.py:1797
Vulnerability Type: Insecure secret storage and exposure through process arguments
Risk Level: Medium

Vulnerable Code and Instructions

SKILL.md:43-48:

markdown
### CurseForge API Key 配置方法 1. 前往 https://console.curseforge.com/ 申请免费 API Key 2. 编辑 `references/curseforge_api.md`，在文件末尾添加：`CF_API_KEY=你的key` 3. 或设置环境变量：`export CF_API_KEY=你的key` 4. 或运行时通过 `--api-key 你的key` 参数传入

scripts/search_mods.py:1537:

python
cf_api_key = getattr(args, "api_key", None) or os.environ.get("CF_API_KEY", "")

The same secret-loading pattern is repeated in the modpack and synchronous search paths:

python
cf_api_key = getattr(args, "api_key", None) or os.environ.get("CF_API_KEY", "") cf_has_key, cf_warning = check_curseforge_api_key(cf_api_key)

scripts/search_mods.py:1797:

python
parser.add_argument("--api-key", default=None, help="CurseForge API Key")

Technical Analysis

The Skill recommends two unsafe methods of supplying a CurseForge API key:

Storing the key in references/curseforge_api.md, a documentation file inside the project repository.

Passing the key through the --api-key command-line option.

A secret stored in a repository file can be accidentally committed to version control, included in archives, copied into reports, exposed to repository collaborators, or retained in source-control history after deletion.

Command-line arguments are also unsuitable for secrets. Depending on the operating system and execution environment, they may be visible through process inspection, audit logs, task monitoring, shell history, CI job logs, or wrapper-tool telemetry.

The repository-file method is additionally inconsistent with the im ...[truncated 1833 chars]
Remediation: View remediation
Remediation Suggestions

Remove all instructions recommending that users store API keys in references/curseforge_api.md or any other tracked project file.

Remove or deprecate the --api-key argument to prevent secrets from appearing in process arguments and shell history.

Prefer the existing CF_API_KEY environment variable for noninteractive execution.

For persistent local configuration, use an operating-system credential store or a configuration file outside the repository with owner-only permissions.

If a local secrets file must be supported, ensure it is excluded through .gitignore, validate restrictive permissions, and clearly warn users never to commit it.

Avoid printing credentials in exceptions, diagnostics, generated commands, or API failure messages.

Add secret scanning to CI and document immediate key revocation and rotation procedures for accidental disclosure.

Update the warning generated by check_curseforge_api_key() so that it recommends only protected secret-delivery methods.

T08 · Insecure Dependencies

Note

Location: SKILL.md:315
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:315-326; equivalent installation guidance at README.md:117-121
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Low

Vulnerable Code and Instructions

SKILL.md:315-326:

markdown
- `asyncio + aiohttp` 并发请求（需安装 `pip install aiohttp`；无 aiohttp 时自动降级到同步模式） - 多关键词并行搜索（`_extract_keywords` 提取 3-5 个候选词） - 快查表优先命中（`references/mod_quickref.md`） - 默认不查依赖（用 `--deps` 开启） - CurseForge API Key 未配置时输出提示信息 - Modrinth 结果 < 3 条时自动触发 MC百科补充搜索 - 所有请求统一设置超时时间（`DEFAULT_TIMEOUT=8s`），避免卡死 ### 安装依赖 ```bash pip install aiohttp # 强烈推荐，启用并发模式

text
Equivalent guidance appears in `README.md`: ```bash pip install aiohttp # recommended for concurrent search

Technical Analysis

The installation command does not pin an audited aiohttp version, constrain transitive dependencies, or verify package hashes. Its effective contents can therefore change after this Skill has been reviewed.

Package installation may execute package build or installation logic with the privileges of the invoking user. If a future package release or transitive dependency is compromised, an otherwise unchanged Skill installation could execute attacker-controlled code. Unpinned versions also increase the likelihood of incompatible API changes and non-reproducible behavior.

No evidence was found that the Skill intentionally installs a typosquatted package or uses an untrusted package index. The risk arises from unconstrained dependency resolution rather than a currently identified malicious package.

Attack Path

A user follows the documented pip install aiohttp command.

The package resolver selects the latest available aiohttp release and its currently resolved transitive dependencies.

A selected release or dependency has been compromised, replaced, or contains malicious installation behavior.

Package installati ...[truncated 709 chars]
Remediation: View remediation
Remediation Suggestions

Add a dependency manifest that pins an audited aiohttp version and all transitive dependencies.

Generate and verify cryptographic hashes, then install with a command such as:

bash
python -m pip install --require-hashes -r requirements.txt

Use a lock-file workflow appropriate to the project's packaging tool and commit the lock file for reproducible installations.

Install dependencies inside a dedicated virtual environment rather than the system Python environment.

Specify the trusted package index explicitly where deployment policy requires it.

Use automated dependency scanning and controlled update reviews to keep the pinned release patched.

Keep the standard-library fallback available so users can run the basic search without installing an optional dependency.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill describes network access to multiple external services and use of environment-provided secrets, but it does not declare any explicit tool scope or permissions boundaries. This creates a least-privilege failure: a host agent may grant broader network or env access than necessary, making unintended outbound requests or secret exposure more likely if the skill is invoked unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list is extremely broad and includes generic Minecraft, modding, and even concept-level terms, which can cause the skill to activate on loosely related user queries. Over-triggering is dangerous here because activation enables external lookups and possible secret-dependent behavior, increasing the chance of unintended data transmission or confusing agent routing.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 73% confidence
Finding: The CurseForge integration requires an API key and explicitly supports pulling that secret from environment variables or runtime parameters, but the skill lacks clear secret-handling boundaries. In combination with missing tool scoping, this increases the risk of credential misuse, accidental exposure, or unauthorized external requests under the skill's authority.
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
- 参考文档：`references/modrinth_api.md` **CurseForge（备选）**： - 调用 `GET https://api.curseforge.com/v1/mods/search` - 参数：`gameId=432`, `searchFilter`, `classId`（mods=6） - 参考文档：`references/curseforge_api.md` - **⚠️ 注意**：需要 `X-API-Key` 请求头。若未配置，**在回答中明确告知用户**：

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The modpack analyzer mode can trigger on vague phrases like '科技包' or any description with three functional directions, which is ambiguous and likely to match normal brainstorming rather than an explicit request to run the skill. Because this mode performs broader analysis and potentially more searches, accidental invocation expands network activity and increases the chance of incorrect or overreaching responses.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction '返回给用户的内容使用中文描述' forces a specific language regardless of the user's preferred language. This is a natural-language locale policy violation because the skill does not offer a language choice or make the Chinese-only constraint explicitly opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document is entirely written in Chinese and instructs AI behavior using Chinese-only descriptions, but it does not indicate that language selection is optional or limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 224)May include surrounding context.
md
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 294)May include surrounding context.
md
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.
md
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/modrinth_api.md (reported line 5)May include surrounding context.
md
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/modrinth_api.md (reported line 41)May include surrounding context.
md
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/modrinth_api.md (reported line 84)May include surrounding context.
md
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/modrinth_api.md (reported line 129)May include surrounding context.
md
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/modrinth_api.md (reported line 168)May include surrounding context.
md
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/search_mods.py (reported line 62)May include surrounding context.
python
# ───────────────────────────────────────────────────────────────────────────── # API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 301)May include surrounding context.
md
# API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/curseforge_api.md (reported line 5)May include surrounding context.
md
# API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/curseforge_api.md (reported line 75)May include surrounding context.
md
# API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/curseforge_api.md (reported line 157)May include surrounding context.
md
# API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/search_mods.py (reported line 63)May include surrounding context.
python
# API 常量 # ───────────────────────────────────────────────────────────────────────────── MODRINTH_BASE = "https://api.modrinth.com/v2" CURSEFORGE_BASE = "https://api.curseforge.com/v1" MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}" MCMOD_SEARCH_URL_NOVER = "https://www.mcmod.cn/s?key={query}&mold=1"

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code sends an Accept-Language: zh-CN,zh;q=0.9 header when querying MC百科, which forces a specific locale preference rather than reflecting user settings or offering opt-in. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The text says the skill 'accepts Chinese queries, returns Chinese descriptions,' which implies language behavior is predetermined for at least some users. Because the README does not mention that users can choose or override the response language, this may conflict with a language/locale choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The parameter reference introduces --api-key and CF_API_KEY, and later setup instructions show users how to place the key in files or environment variables. While functional setup is documented, there is no explicit warning that this is a credential that should be kept secret and handled carefully.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 该文件的标题与全文说明均以中文编写，没有任何迹象表明技能允许用户选择语言，或该语言限制是出于明确的地区合规/受众要求。根据规则，强制特定语言而无用户选择属于自然语言层面的语言/locale policy violation。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing guidance exclusively in Chinese, which can amount to a language/locale constraint if the broader skill does not explicitly opt users into that language. The policy for this audit requires flagging forced language choices unless the locale limitation is clearly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code and Instructions

Technical Analysis

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code and Instructions

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Undeclared Tool Scope

Vague Triggers

External Transmission

Vague Triggers

Natural-Language Policy Violations

Natural-Language Policy Violations

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis