Tianapi Dgryl - 打工人语录

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:06 AM UTC
• Version: 1.0.0

Overview

This is a straightforward TianAPI quote-fetching skill, with the main caution that its examples can expose the TianAPI API key through command-line history, a local .env file, or provider URL logs.

Install only if you are comfortable giving the skill a TianAPI key and allowing it to contact TianAPI. Prefer the TIANAPI_DGRYL_KEY environment variable or a managed secret store, avoid passing the key on the command line, do not commit scripts/.env, restrict its permissions if used, and rotate the key if it may have appeared in shell history or logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_dgryl.py:105

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:27

Finding

Plaintext API Key Storage Without Enforced File Permissions

Content

View full analysis

scripts/.env ``` The script then reads the plaintext file: ```python env_file = Path(__file__).parent / ".env" if env_file.exists(): try: content = env_file.read_text(encoding="utf-8") for line in content.splitlines(): line = line.strip() if line.startswith(f"{ENV_KEY_NAME}="): return line.split("=", 1)[1].strip().strip('"\'') except Exception: pass ``` ### Technical Analysis The `.env` file contains a reusable API credential in plaintext. The documented creation command relies entirely on the user's current umask and directory permissions; it does not ensure that only the owner can read the file. The script also does not inspect or reject insecure file permissions before loading the credential. Plaintext storage can be acceptable in some local configurations, but only when access is appropriately restricted and the file is excluded from source control, backups, build artifacts, and logs. The network call itself does not require broad local-file privileges. Reading one fixed configuration file is reasonably scoped to the declared function, but documenting creation without access-control safeguards creates avoidable credential exposure. ### Attack Path 1. A user follows the documentation and creates `scripts/.env`. 2. The user's umask or directory configuration permits another local account or service to read the file, or the file is accidentally committed, archived, or included in a build artifact. 3. An unauthorized party reads `TIANAPI_DGRYL_KEY` from the file. 4. The party reuses the key against TianAPI. 5 ...[truncated 409 chars]

Remediation

View remediation

scripts/.env chmod 600 scripts/.env ``` 2. Add `.env` and `scripts/.env` to the project's version-control ignore rules. 3. Check file ownership and permission bits before reading the credential on platforms that support them. Warn or refuse to proceed when group or other users can read the file. 4. Prefer a secret manager, protected environment injection, or operating-system credential store for production use. 5. Document that the file must not be committed, copied into container images, attached to support tickets, or included in public build artifacts. 6. Rotate the key if the `.env` file has ever been publicly committed or broadly readable. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_dgryl.py:76

Finding

API Key Included in URL Query Parameters

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill instructs users to place the API key into scripts/.env, which can lead to credentials being stored in the project workspace where they may be accidentally committed, read by other tools, or exposed through logs and debugging. Although common in developer workflows, embedding secrets in local files materially increases credential leakage risk.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_DGRYL_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_DGRYL_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The documentation shows passing the API key directly on the command line, which can expose the secret via shell history, process listings, audit logs, and terminal recordings. In agent or shared-system contexts this is particularly risky because other users or tools may be able to observe command invocations.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

export TIANAPI_DGRYL_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_DGRYL_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_dgryl.py --key 你的APIKey

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_dgryl.py (reported line 14)May include surrounding context.

python

Env Config:
    export TIANAPI_DGRYL_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_DGRYL_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_dgryl.py (reported line 34)May include surrounding context.

python

Env Config:
    export TIANAPI_DGRYL_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_DGRYL_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_dgryl.py (reported line 39)May include surrounding context.

python

Env Config:
    export TIANAPI_DGRYL_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_DGRYL_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_dgryl.py (reported line 48)May include surrounding context.

python

Env Config:
    export TIANAPI_DGRYL_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_DGRYL_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_dgryl.py (reported line 49)May include surrounding context.

python

if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation indicates capabilities involving environment variables, file access, and outbound network use, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege gap: an agent may grant broader-than-necessary execution context to a skill that handles secrets and performs network requests, increasing the chance of unintended secret exposure or unsafe tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code constructs a query string containing the API key and sends it to a remote HTTP endpoint. Although network access is part of the script's purpose, there is no explicit user-facing warning in the code or docstring that the provided key will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language documentation and several user-facing messages are written only in Chinese, with no indication of language choice or opt-in. Under the policy, forcing a specific language without user choice can be a locale/language policy violation.

Content

No source excerpt is available for this finding.