Tianapi Ancbooks - 古籍查询

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward TianAPI ancient-text lookup helper, with credential-handling caveats users should manage carefully.

Install only if you are comfortable giving the skill a TianAPI key. Prefer TIANAPI_ANCBOOKS_KEY over command-line arguments or scripts/.env, avoid sharing logs or shell history that may contain the key, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_ancbooks.py:73

Finding

API Credential Exposed in URL Query String

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_ancbooks.py:73-78
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

python

params = {
    "key": self.api_key,
    "id": anc_id.strip()
}
query_string = urllib.parse.urlencode(params)
url = f"{API_ENDPOINT}?{query_string}"

Technical Analysis

The script embeds the TianAPI credential directly in the request URL. Although the endpoint uses HTTPS, TLS only protects the request while it is in transit. The complete URL may still be recorded by the API provider, reverse proxies, gateways, monitoring systems, exception diagnostics, or local debugging tools.

The Skill also permits the credential to be supplied through the --key command-line option at scripts/fetch_ancbooks.py:107. Command-line secrets may be retained in shell history or exposed through process inspection while the command is running. These credential-handling methods unnecessarily increase the number of locations in which the API key can appear.

Sending an authentication credential to TianAPI is necessary for the declared chapter-lookup functionality. The security concern is therefore not an undeclared network destination or excessive data collection, but the use of exposure-prone credential transport and input mechanisms.

Attack Path

1. A user invokes the Skill with a valid TianAPI key.
2. The script constructs a URL containing the key in its query string.
3. A server, proxy, gateway, tracing service, or diagnostic system records the complete request URL.
4. Alternatively, when --key is used, a local user obtains the key from shell history or process metadata.
5. An attacker with access to one of these records extracts the key.
6. The attacker submits unauthorized TianAPI requests using the recovered credential.

Exploitation requires access to relevant local metadata, command history, infrastructure logs, or provider-side ...[truncated 636 chars]

Remediation

View remediation

Remediation Suggestions

1. If TianAPI supports it, send the credential in an authorization header or a POST request body rather than in the URL.
2. Remove or deprecate the --key command-line option. Prefer the dedicated TIANAPI_ANCBOOKS_KEY environment variable or a protected credential store.
3. If TianAPI mandates query-string authentication, clearly document that limitation and configure all application, proxy, gateway, tracing, and error logs to redact the key parameter.
4. Avoid logging the constructed URL or exception objects that could contain it.
5. If .env support is retained, require owner-only file permissions and ensure the file is excluded from version control and package artifacts.
6. Update the usage documentation to recommend environment-based credential loading exclusively.
7. Rotate any API key suspected of having appeared in shell history, process telemetry, or request logs.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill instructs users to place the API key into a local .env file under the scripts directory, which can lead to credential exposure through accidental commits, backups, workspace sharing, or other tooling that reads local files. In agent-based environments, encouraging file-based secret storage inside the project tree can make the credential easier to discover or exfiltrate than using isolated secret injection.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_ANCBOOKS_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_ANCBOOKS_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill explicitly shows passing the API key as a command-line argument, which is dangerous because process arguments may be exposed through shell history, process listings, audit logs, CI logs, or agent telemetry. This is more dangerous in shared or monitored environments because other users or tools may retrieve the secret without needing direct file access.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

export TIANAPI_ANCBOOKS_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_ANCBOOKS_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_ancbooks.py --key 你的APIKey --id 9872ed9fc22fc182

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ancbooks.py (reported line 14)May include surrounding context.

python

Env Config:
    export TIANAPI_ANCBOOKS_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_ANCBOOKS_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ancbooks.py (reported line 34)May include surrounding context.

python

Env Config:
    export TIANAPI_ANCBOOKS_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_ANCBOOKS_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ancbooks.py (reported line 39)May include surrounding context.

python

Env Config:
    export TIANAPI_ANCBOOKS_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_ANCBOOKS_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ancbooks.py (reported line 48)May include surrounding context.

python

Env Config:
    export TIANAPI_ANCBOOKS_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_ANCBOOKS_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ancbooks.py (reported line 49)May include surrounding context.

python

if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documentation indicates capabilities to read environment variables, access files, and make network requests, but it does not declare any explicit tool scope or permissions. This creates an over-privileged and under-specified execution model where a host agent may grant broader access than necessary, increasing the blast radius if the script is modified, compromised, or misused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.