Oil Price - 实时油价查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.0.0

Overview

The skill appears to query TianAPI oil prices as claimed, but its API key handling can expose the user's credential.

Install only if you are comfortable sending province queries and your TianAPI key to TianAPI. Prefer using the TIANAPI_OIL_PRICE_KEY environment variable, avoid command-line key arguments and copied GET URLs containing the key, do not commit scripts/.env, and use a dedicated quota-limited key you can rotate.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_oil_price.py:81

Finding

API Credential Exposure Through Command-Line Arguments and URL Query Parameters

Content

View full analysis

GET https://apis.tianapi.com/oilprice/index?key=YOUR_API_KEY&prov=Hubei ``` ### Technical Analysis The script places the TianAPI key in a URL query parameter. Although the endpoint uses HTTPS, which protects the request from ordinary network interception in transit, HTTPS does not prevent the complete URL from being recorded by client diagnostics, reverse proxies, API gateways, monitoring systems, server access logs, or exception-reporting infrastructure. The script also supports receiving the API key through `--key`. Command-line secrets can be retained in shell history and may be visible in process inspection facilities while the command is running. The documentation further encourages users to place the key directly in commands and URLs, increasing the likelihood of accidental disclosure through terminal history, screenshots, copied logs, or shared troubleshooting output. Sending an authentication credential to the declared TianAPI service is necessary for the Sk ...[truncated 1613 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The documentation recommends writing the API key into scripts/.env within the project tree, which increases the risk of accidental disclosure through source control, workspace sharing, backups, or other tools that read local files. Secrets stored in accessible project files are materially easier to exfiltrate than secrets kept only in protected environment configuration.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_OIL_PRICE_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_OIL_PRICE_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill also documents passing the API key as a command-line argument, which can expose the secret via shell history, process listings, job control logs, or telemetry. While convenient, CLI arguments are a well-known unsafe channel for credentials on multi-user or monitored systems.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

export TIANAPI_OIL_PRICE_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_OIL_PRICE_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_oil_price.py 你的APIKey

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_oil_price.py (reported line 17)May include surrounding context.

python

Env Config:
    export TIANAPI_OIL_PRICE_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_OIL_PRICE_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_oil_price.py (reported line 37)May include surrounding context.

python

Env Config:
    export TIANAPI_OIL_PRICE_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_OIL_PRICE_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_oil_price.py (reported line 42)May include surrounding context.

python

Env Config:
    export TIANAPI_OIL_PRICE_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_OIL_PRICE_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_oil_price.py (reported line 51)May include surrounding context.

python

Env Config:
    export TIANAPI_OIL_PRICE_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_OIL_PRICE_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_oil_price.py (reported line 52)May include surrounding context.

python

if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents capabilities that involve reading environment variables, accessing local files such as scripts/.env, and making outbound network requests, but it does not declare an explicit tool scope or permission boundary. That creates a governance gap: an agent may invoke the skill with broader-than-expected access, and users are not clearly informed what resources the skill may touch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs using an API key with an external service but does not clearly warn the user that requests send data to TianAPI and may use a locally stored secret. Lack of explicit disclosure undermines informed consent and can lead to unintentional transmission of sensitive credentials or query data to a third party.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation guidance is broad enough to trigger on common questions about oil prices without clear boundaries, which can cause the agent to invoke the skill automatically when a simple conversational answer might suffice. In practice this increases the chance of unnecessary external calls and unintended use of stored credentials.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module documentation advertises a JSON mode via the --json flag, but argparse only defines --key and --prov. Later, the code reads args.json, so the documented interface contradicts the implemented CLI behavior and will fail at runtime instead of supporting the stated mode.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language instructions, examples, and error/help text are presented in Chinese only, which forces a specific language experience for users. The file does not offer a language choice or document that the tool is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code builds a request containing the API key and province, then sends it to a third-party service. Although the module docstring describes the tool's purpose, it does not explicitly warn that user-supplied inputs and the credential will be transmitted over the network.

Content

No source excerpt is available for this finding.