Category News - 分类新闻

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward TianAPI news fetcher, but its documented and implemented credential handling can unnecessarily expose the user's API key.

Review this skill before installing. Prefer a protected environment variable, avoid passing the TianAPI key on the command line, do not store it in a project .env file unless permissions and gitignore rules are controlled, and rotate the key if it has already been used in command examples or logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_allnews_news.py:89

Finding

API Credential Exposure Through Process Arguments and URL Query Parameters

Content

View full analysis

python3 scripts/fetch_allnews_news.py [num] [word] [page] GET https://apis.tianapi.com/allnews/index?key=YOUR_API_KEY&col=7&num=10&page=1 ``` ### Technical Analysis Sending the API key to the declared TianAPI service is necessary for the Skill's news-fetching functionality, and the request uses HTTPS. No evidence indicates that the key is sent to an unrelated host. However, the chosen credential-handling mechanisms create avoidable exposure surfaces: 1. A key supplied through `--key` is part of the process command line. It can be retained in shell history and may be observable through local process-inspection or au ...[truncated 2293 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The skill instructs users to place the API key into a local .env file under the scripts directory, which is a credential-handling pattern that can expose secrets through accidental commits, workspace reads, or other tooling that scans files. In an agent context, storing credentials in readable project files is riskier than environment-only handling because other skills or processes may access the file.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_ALLNEWS_NEWS_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_ALLNEWS_NEWS_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill explicitly recommends passing the API key as a command-line argument, which can leak credentials via shell history, process listings, audit logs, and agent telemetry. In an automated agent environment, this is especially dangerous because secrets provided on the command line are often captured by orchestration and debugging systems.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

export TIANAPI_ALLNEWS_NEWS_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_ALLNEWS_NEWS_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_allnews_news.py 你的APIKey 7

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_allnews_news.py (reported line 20)May include surrounding context.

python

Env Config:
    export TIANAPI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_allnews_news.py (reported line 50)May include surrounding context.

python

Env Config:
    export TIANAPI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_allnews_news.py (reported line 55)May include surrounding context.

python

Env Config:
    export TIANAPI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_allnews_news.py (reported line 64)May include surrounding context.

python

Env Config:
    export TIANAPI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_allnews_news.py (reported line 65)May include surrounding context.

python

if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation indicates capabilities that involve environment variables, local file access, and outbound network use, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. This is dangerous because an agent may execute the skill with broader-than-necessary privileges, increasing the chance of unintended secret access or uncontrolled external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The API key is placed into the URL query string, which can leak via logs, browser/history equivalents, reverse proxies, monitoring systems, or exception traces even when HTTPS is used. In an agent/automation context, this is more dangerous because tooling often captures full request URLs for debugging and telemetry, increasing the chance of credential exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring advertises a '--json' mode suitable for agent use, but argparse only defines --key, --col, --num, and --page. The later check of args.json therefore references an undeclared option, so the documented behavior is not actually implemented.

Content

No source excerpt is available for this finding.