Nutrient Query - 营养成分表

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:14 AM UTC
• Version: 1.0.0

Overview

This is a coherent TianAPI nutrient lookup skill, with avoidable API-key handling risks but no evidence of hidden, destructive, persistent, or unrelated behavior.

Install only if you are comfortable sending food search terms to TianAPI. Prefer setting TIANAPI_NUTRIENT_KEY through your environment or secret manager, avoid passing keys on the command line, avoid committing scripts/.env, and rotate the key if it appears in terminal history or logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

python3 scripts/fetch_nutrient-query.py --mode 1 --num 5 --page 2 ``` The script also explicitly accepts the credential as a command-line option: ```python # scripts/fetch_nutrient-query.py:158 parser.add_argument("--key", help="API Key (可选，优先使用环境变量)") ``` ### Technical Analysis The documentation instructs users to include a TianAPI credential directly in the command line, while the implementation supports the same behavior through `--key`. Command-line secrets may be: - Saved in interactive shell history. - Visible in process listings while the program is running. - Captured by endpoint monitoring, process auditing, or diagnostic software. - Included in copied terminal transcripts and support logs. The documented positional command syntax is also inconsistent with the implementation, which requires named `--key` and `--word` options. Although this mismatch primarily affects reliability, users trying to correct the command may still place the secret in a visible `--key` argument. ### Attack Path 1. A user follows the Skill instructions or invokes the script with `--key`. 2. The API key becomes part of the process command line and may be recorded in shell history. 3. Another local user, monitoring agent, support operator, or process with access to history or process telemetry retrieves the key. 4. The exposed key is used to submit unauthorized requests to TianAPI. 5. The attacker consumes the victim's API quota or accesses any API operations authorized for that key. This path requires access to local process information ...[truncated 563 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_nutrient-query.py:87

Finding

API Key Included in URL Query String

Content

View full analysis

&word= ``` HTTPS protects the URL from ordinary network interception while it is in transit. The destination is also the declared TianAPI provider, so this request is necessary for the Skill's API-backed nutrient lookup and is not evidence of unrelated data exfiltration. However, query strings are frequently retained in: - API-provider access logs. - Reverse-proxy and gateway logs. - Network monitoring and observability systems. - Application traces and diagnostic telemetry. - Error reports that capture complete request URLs. Credentials in URLs therefore have a larger accidental exposure surface than credentials sent through authorization headers. The current exception handling does not explicitly print the URL, but downstream infrastructure may still record it. ### Attack Path 1. The user runs a nutrient query with a valid TianAPI key. 2. The script constructs a complete URL containing that key. 3. A provider, proxy, monitoring product, or diagnostic system records the full request URL. 4. An actor with access to those logs extracts the `key` query parameter. 5. The actor reuses the key for unauthorized TianAPI reques ...[truncated 637 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill instructs users to store the API key in a local .env file under the scripts directory, which can be accidentally committed, exposed through workspace reads, or harvested by other tools with file access. Because the key is a reusable credential for outbound API access, disclosure can lead to unauthorized use, quota exhaustion, and account abuse.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_NUTRIENT_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_NUTRIENT_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill also recommends passing the API key directly as a command-line argument. Command-line secrets are commonly exposed via shell history, process listings, logs, and telemetry, making credential leakage significantly more likely than using environment-based secret injection.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

export TIANAPI_NUTRIENT_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_NUTRIENT_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_nutrient-query.py 你的APIKey 油条

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_nutrient-query.py (reported line 20)May include surrounding context.

python

Env Config:
    export TIANAPI_NUTRIENT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_NUTRIENT_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_nutrient-query.py (reported line 40)May include surrounding context.

python

Env Config:
    export TIANAPI_NUTRIENT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_NUTRIENT_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_nutrient-query.py (reported line 45)May include surrounding context.

python

Env Config:
    export TIANAPI_NUTRIENT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_NUTRIENT_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_nutrient-query.py (reported line 54)May include surrounding context.

python

Env Config:
    export TIANAPI_NUTRIENT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_NUTRIENT_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_nutrient-query.py (reported line 55)May include surrounding context.

python

if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill describes executable behavior that uses environment variables, local files, and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it easier for an agent runtime to grant broader capabilities than are necessary, increasing the blast radius if the skill or its inputs are abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language interface, examples, help text, and user-facing messages are written in Chinese, and the script does not offer users any language or locale selection. This can violate a language/locale policy when a skill forces a specific language without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation explicitly shows a '--json' usage mode suitable for agent calls, creating the expectation that this option is supported. However, the argument parser never adds a '--json' flag, while main() still checks 'args.json', so the documented behavior contradicts the implemented interface and will fail at runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code constructs an outbound HTTP request containing both the user's query term and the API key, but the runtime path provides no explicit user-facing disclosure such as a print/log message before transmission. Although the module docstring describes use of an external API, the active execution path does not visibly warn the user that input data will be sent to a third-party service.

Content

No source excerpt is available for this finding.