Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent paid comics service integration, but it asks the assistant to handle login codes, bearer keys, local credential persistence, and paid account actions in ways users should review carefully.
Install only if you are comfortable with the assistant helping manage a paid wwzu.com account. Prefer creating the API key yourself in the website and storing it in a trusted secret store; avoid pasting one-time login codes or full API keys into chat, and require explicit confirmation before any action that spends money, points, or changes account state.
This is a true security-design issue: the agent is instructed to collect an email OTP, exchange it for a login token, and create credentials for the account. That gives the conversational channel direct involvement in user authentication and credential issuance, which is especially dangerous because the skill is handling both the authentication factor and the resulting bearer token/API key lifecycle.
The fallback flow asks the user to paste a plaintext API key into the conversation so the agent can install it. API keys are bearer secrets; collecting them in chat exposes them to transcript retention, accidental disclosure, and misuse, and the skill itself notes the key is only shown in plaintext once, increasing recovery pressure and user risk.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _load_env_file() -> None:
"""可选：从脚本同目录及当前目录的 .env 补充 XIANMU_API_KEY（真实环境变量优先）。"""
if os.environ.get("XIANMU_API_KEY"):
return
here = os.path.dirname(os.path.abspath(__file__))
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if os.environ.get("XIANMU_API_KEY"):
return
here = os.path.dirname(os.path.abspath(__file__))
for path in (os.path.join(here, ".env"), os.path.join(os.getcwd(), ".env")):
try:
with open(path, encoding="utf-8") as fh:
for line in fh:
The skill explicitly instructs the agent to use environment variables and make authenticated network requests, but it does not declare any corresponding tool scope restrictions such as allowed tools or permissions. This creates a capability mismatch: an agent/runtime may grant broader access than the user expects, increasing the chance of unintended secret access or outbound requests during execution.
The activation rules are intentionally broad and include many ambiguous keywords and even indirect mentions, causing the skill to trigger when the user may not actually be requesting this service. Over-triggering can lead to unnecessary collection of emails, API keys, or payment-related interaction in contexts where the user did not clearly consent to engage this paid external service.
The markdown instructs the agent to guide users through email-code login and notes that logging in this way rotates the existing remember_token and invalidates prior web sessions. Although this side effect is mentioned, the document does not present it as a prominent warning before starting the flow, despite affecting the user's existing access state.
The document states that pricing wording 'must be accurate when relayed to the user' and the rest of the skill guidance is written as fixed Chinese customer-facing phrasing, but it does not tell the agent to respect the user's preferred language. For an otherwise bilingual skill, this can lead to a locale-policy issue if the agent defaults to Chinese without opt-in.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 直连协议参考（MCP Streamable HTTP）
`scripts/xianmu_mcp.py` 已封装下述全部细节；本文件供无 Python 环境时用 curl 兜底，或排查问题时理解原理。
## 端点与鉴权
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
SID=$(grep -i '^mcp-session-id:' /tmp/xm_headers | tr -d '\r' | awk '{print $2}')
# 2) notifications/initialized —— 返回 202，无响应体
curl -sS -o /dev/null -w "%{http_code}\n" "$URL" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "Authorization: Bearer $KEY" \
The skill exposes a paid chat operation where each character message costs points, but the documentation does not require an explicit pre-call warning or user confirmation before spending balance. In an agent setting, this can lead to unintended microtransactions through normal conversation flow, especially because chat is framed as seamless and quota-free, which may cause the agent to invoke it without making the cost salient to the user.
These tools can unlock content, create payment orders, recharge points, and purchase VIP plans, all of which affect the user's account or initiate charges, yet the documentation lacks an explicit safety requirement for confirmation before execution. In an agentic environment, this creates a real risk of unauthorized purchases, balance depletion, or payment workflow initiation from ambiguous user requests or over-eager automation.
The workflow tells the agent to ask the user for a 6-digit email verification code and then use it to log in or auto-register on the user's behalf inside the chat. That delegates a sensitive authentication factor to the agent and creates account-takeover, privacy, and token-handling risk, especially because the same flow can invalidate existing sessions and obtain a bearer token.
The instructions normalize collecting a one-time email verification code through the conversation without a strong warning that this is a credential-equivalent secret. OTPs are highly sensitive, and asking users to read them aloud into chat trains unsafe behavior and exposes the code to logging, retention, or misuse.
The skill instructs modifying shell startup files or Windows environment variables to persist an API key, which is a security-sensitive local configuration change. Even with user consent, having the agent direct or potentially perform this step increases the chance of credential leakage, accidental persistence in insecure locations, and unsafe command execution patterns.
The workflow recommends writing a secret into shell profile files or environment variables without an explicit security warning about changing local configuration and persisting credentials. Users may not understand the blast radius of storing plaintext secrets in startup files, terminal history, or shared machines.
The module docstring that serves as the script's help output is entirely in Chinese, and the program prints Chinese-only operational and error messages. This imposes a specific language on users without any documented opt-in or alternative, which is a natural-language locale policy concern under the language-choice rule.
A skill reference that assumes a single language can violate language/locale policy when it does not provide user choice or document that the locale restriction is intentional. Here, the whole document is Chinese-only and does not mention alternative language availability or a justified region-specific constraint.
The documentation instructs users to place an API key in a shell variable and mentions loading it from a local .env file, but it does not warn about common secret-handling risks such as shell history leakage, accidental commits of .env files, or exposure to other local users/processes. This is a real but low-severity documentation security issue because it can lead to credential disclosure through unsafe operator behavior rather than a direct software flaw.
The reset_daily_quota operation directly spends 100 points to reset usage, but the tool description does not mandate a clear pre-execution warning or explicit approval. Although lower impact than full purchases, it still modifies account state and consumes currency-like balance, so accidental invocation could cause preventable loss.
No suspicious patterns detected.