日常物体检测

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.0

Overview

The skill appears intended for remote image object detection, but it stores API keys in plaintext and has mismatched, under-scoped API configuration that should be reviewed before installation.

Install only if you are comfortable sending image URLs or full base64 image data to the XiaoBenYang remote API and storing the XiaoBenYang API key in a local plaintext .env file. Prefer using a disposable or tightly scoped API key, review the .env permissions, avoid sensitive/private images, and verify the endpoint configuration before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:11

Finding

Configurable API Endpoint Enables Credential and Image-Data Redirection

Content

View full analysis

Vulnerability Details

File Location: scripts/config.py:11-22; data transmission occurs at scripts/call_api.py:50-68
Vulnerability Type: Unvalidated configurable endpoint receiving sensitive credentials and user data
Risk Level: Medium

Vulnerable Code

scripts/config.py:11-22:

python

model_config = SettingsConfigDict(
    env_prefix="XBY_GAOKAO_",
    env_file=".env",
    env_file_encoding="utf-8",
    extra="ignore",
)

# API configuration
base_url: str = "https://mcp.xiaobenyang.com"
mcp_id: str = "1820705335657482"
api_key: str = ""

scripts/call_api.py:50-68:

python

url = f"{settings.base_url}/api"
mcp_id = mcp_id or settings.mcp_id

api_key = get_api_key()
if not api_key:
    raise UpstreamError("API密钥未设置，请先调用 set_api_key()")

headers = {
    "XBY-APIKEY": api_key,
    "func": tool_name,
    "mcpid": mcp_id,
    "Content-Type": "application/json",
}

t0 = time.time()
try:
    resp = self._session.post(
        url=url,
        headers=headers,
        data=json.dumps(params),
        timeout=settings.timeout_seconds,
    )

Technical Analysis

Pydantic settings use the XBY_GAOKAO_ environment-variable prefix, allowing base_url to be overridden through XBY_GAOKAO_BASE_URL. The HTTP client constructs its destination directly from that configurable value and attaches the API key in the XBY-APIKEY header.

No validation restricts the destination to HTTPS or to the expected mcp.xiaobenyang.com hostname. Consequently, anyone able to influence the process environment or configuration can redirect requests to an arbitrary server. The request body contains either an externally supplied image URL or Base64-encoded image data.

The client also relies on the default redirect behavior of requests without explicitly validating redirect destinations. This creates an additional opportunity for sensitive request handling to devia ...[truncated 1219 chars]

Remediation

View remediation

Remediation Suggestions

• Make the production API endpoint immutable when runtime endpoint customization is unnecessary.
• If configurability is required, parse the URL and require:
  • The https scheme.
  • An exact approved hostname, such as mcp.xiaobenyang.com.
  • An approved port and path.
  • No embedded credentials.
• Reject alternate hosts, IP-literal destinations, and malformed URLs.
• Disable automatic redirects for authenticated requests or validate every redirect destination against the same allowlist before following it.
• Keep API credentials scoped to the minimum required permissions and support prompt rotation after suspected disclosure.
• Add tests proving that environment variables cannot redirect credentials to unapproved destinations.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/config.py:43

Finding

API Key Is Persisted in Plaintext Without Explicit Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/config.py:43-61
Vulnerability Type: Insecure local storage of authentication credentials
Risk Level: Low

Vulnerable Code

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
        found = False
        new_lines = []
        for line in lines:
            if line.startswith("XBY_APIKEY="):
                new_lines.append(f"XBY_APIKEY={api_key}")
                found = True
            else:
                new_lines.append(line)
        if not found:
            new_lines.append(f"XBY_APIKEY={api_key}")
        env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8")
        os.environ["XBY_APIKEY"] = api_key
        return True
    except Exception as e:
        print(f"保存API key失败: {e}")
        return False

Technical Analysis

The Skill stores the API key as plaintext in .env using Path.write_text(). It does not explicitly create the file with owner-only permissions, verify existing file ownership or permissions, or use a protected credential store.

The resulting access permissions depend on the process umask and any preexisting file metadata. In a shared or permissively configured workspace, another local user or process may be able to read the credential. Persisting the key in the current working directory also increases the likelihood of accidental inclusion in backups, build artifacts, or version-control commits.

Attack Path

1. A user supplies an API key as required by the Skill.
2. set_api_key() calls save_api_key_to_env().
3. The key is written in plaintext as XBY_APIKEY=<secret> in the current directory's .env file.
4. If filesystem permissions, workspace sharing, backups, or r ...[truncated 646 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer an operating-system credential manager, managed secret service, or runtime-only environment variable instead of persistent plaintext storage.
• If file persistence is unavoidable:
  • Create the file atomically with mode 0600.
  • Verify that the file is owned by the current user.
  • Reject unsafe preexisting files and unexpected file types.
  • Store it in a user-specific configuration directory rather than an arbitrary working directory.
• Ensure .env is excluded from version control, package artifacts, diagnostic bundles, and backups where possible.
• Document credential rotation and revocation procedures.
• Avoid printing or logging the credential under all error conditions.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Dependency Versions Prevent Reproducible and Reviewed Builds

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: Unpinned third-party dependencies and supply-chain exposure
Risk Level: Low

Vulnerable Code

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Technical Analysis

Every dependency is specified with an open-ended minimum version and no upper bound, lock file, or integrity hash. Two installations performed at different times can therefore resolve to different package versions that have not necessarily undergone review for this project.

The listed package names are established packages, and the reviewed files provide no evidence of typosquatting or a currently malicious dependency. The risk arises because future, compromised, or incompatible releases can be selected automatically during a fresh installation.

Attack Path

1. A fresh environment installs the project requirements at a later date.
2. The package resolver selects the newest versions satisfying each >= constraint.
3. A selected release contains a newly introduced vulnerability, malicious modification, or incompatible behavior.
4. The affected package code executes during installation, import, or normal Skill operation.
5. Any resulting access occurs with the privileges of the account or service running the installation or Skill.

This path depends on a compromised or vulnerable upstream release; no such specific release was established by the reviewed evidence.

Impact Assessment

Potential impact depends on the affected dependency and can range from availability failures to data disclosure or arbitrary code execution with the privileges of the Skill process. The absence of exact versions and hashes also weakens build reproducibility and incident investigation.

No direct compromise is demonstrated solely by the current requirement declarations, so this is assessed as a low-risk supply-cha ...[truncated 19 chars]

Remediation

View remediation

Remediation Suggestions

• Generate and commit a reviewed lock file containing exact transitive dependency versions.
• Use hash-verified installation, such as pinned requirements with --require-hashes.
• Apply upper bounds where compatibility requires them.
• Retrieve packages only from an approved package index over TLS.
• Enable automated vulnerability and dependency-change monitoring.
• Review and test upgrades through a controlled update process rather than resolving the newest versions during production deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to perform image detection, yet the file emphasizes API key storage in .env, environment persistence, and even references a mismatched project/domain ('gaokao'), all of which undermine confidence that the skill is limited to the advertised task. That inconsistency makes the skill more dangerous because it suggests copy-pasted or repurposed infrastructure that may route data somewhere unintended or handle credentials unsafely.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to perform image detection, yet the file emphasizes API key storage in .env, environment persistence, and even references a mismatched project/domain ('gaokao'), all of which undermine confidence that the skill is limited to the advertised task. That inconsistency makes the skill more dangerous because it suggests copy-pasted or repurposed infrastructure that may route data somewhere unintended or handle credentials unsafely.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The model_post_init method explicitly opens and reads the .env file to extract XBY_APIKEY, bypassing the normal typed settings flow. Manual secret harvesting increases the attack surface and makes hidden credential collection harder to audit, especially in a skill whose declared purpose is unrelated to credential management.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Creating a Path to .env for direct secret access is part of the same manual credential collection pattern and supports plaintext secret retrieval from local disk. In context, this is dangerous because the skill's advertised function does not justify direct credential file handling.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The code directly reads XBY_APIKEY from the process environment outside the declared XBY_GAOKAO_ namespace, which can unintentionally capture a generic credential meant for another tool or component. This weak secret scoping and variable confusion can lead to misuse of unrelated credentials.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is declared as an image object detection capability, but this file adds functionality to persist and retrieve API credentials from a local .env file and process environment variables. That mismatch expands the skill's privileges beyond its stated purpose and creates unnecessary secret-handling behavior, which increases the risk of credential exposure or misuse if the skill is installed or reviewed under false assumptions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The save_api_key_to_env function writes an API key into a local .env file, creating durable secret storage on disk without a demonstrated need tied to object detection. Local plaintext persistence makes credentials easier to leak through source packaging, backups, logs, or accidental inclusion in repositories.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This function is explicitly designed to save an API key into .env, creating plaintext local secret persistence and enabling long-term credential retention. In the context of an object-detection skill, this behavior is unnecessary and materially increases the chance of credential theft through file leakage, repository inclusion, or host compromise.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though its documented behavior implies access to environment variables, file read/write, and outbound network capabilities. In a skill that collects API keys and persists them, the absence of explicit scope increases the risk of overbroad access and makes it harder to constrain misuse or review what the skill is actually allowed to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells the agent to ask the user for an API key and save it via configuration without warning about persistence, storage location, reuse, or who can access it. Collecting and storing secrets in this way creates credential-handling risk, especially when the same skill also appears to have file and environment access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow example instructs the model to call an unrelated tool (search_schools) despite the skill being presented as an object-detection skill. Incorrect tool-call guidance can cause invocation of unintended functions, data disclosure to the wrong backend, or execution outside the user's expected context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill promises a constrained output of bounding boxes, confidence scores, and labels, but the return-handling section instructs the agent to display raw API responses directly. Raw upstream payloads may contain extra metadata, request echoes, internal IDs, or even secrets, violating least-privilege disclosure and expanding the data exposed to users.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to show result["raw"] directly to the user can expose sensitive content returned by the remote service, including echoed user inputs, internal metadata, URLs, tokens, or debugging details. This is especially risky here because the skill relies on a remote API and accepts user-supplied image URLs or base64 data, making accidental disclosure more plausible.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a narrowly scoped skill that detects people/pets/cars/fire/cardboard boxes in an input image and returns boxes, confidences, and labels. This code instead exposes a generic call_tool(mcp_id, tool_name, params) mechanism that can POST arbitrary parameters to a remote API with a caller-supplied tool name, which is a broader capability than justified by the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends params to an upstream HTTP API and includes an API key in request headers, which is a privacy- and security-relevant network operation. While the file has internal logging for failures/success, it lacks any confirmation prompt, print/log intended for the user, or explanatory comments/docstrings warning that user-supplied data will be transmitted to an external service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The configuration advertises an env_prefix of XBY_GAOKAO_ but the post-init logic bypasses that namespace and directly reads XBY_APIKEY from .env and the process environment. This inconsistency can cause operators to misunderstand which secret is being consumed, increasing the chance of accidental cross-skill credential reuse or unintended secret capture.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code persists the API key to .env automatically and silently, with no confirmation, warning, or disclosure to the user that a plaintext credential is being stored on disk. This weakens informed consent and can leave long-lived secrets behind in environments where users expected only temporary in-memory use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function sends a user-supplied image URL to an external API service, but this file provides no disclosure, consent flow, or privacy warning to the caller. Because image inputs can contain sensitive personal or environmental information, silent transmission to a third party creates a real privacy and data-handling risk, especially in an object-detection skill processing people, pets, vehicles, or scenes from private spaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This function transmits raw base64-encoded image content to an external API without any user-facing notice in the code or interface description. Sending the full image bytes is particularly sensitive because it can expose personal, location, and contextual information directly to a third party, and the skill context involves routine object detection over potentially private user photos.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire skill metadata and instructions are presented only in Chinese, and no option is given for another language or for user language preference. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only, so builds may resolve to different versions over time. This weakens supply-chain control and makes it difficult to guarantee that a non-vulnerable, tested version of requests is installed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

requests has multiple known advisories, and because the manifest does not pin a specific version, there is no way to verify whether deployment will use a fixed or affected release. The risk is contextual here because requests often handles outbound HTTP where URL parsing, TLS, redirects, or credential handling bugs can matter.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using pydantic with only a minimum version allows later versions to be installed implicitly, which can introduce unreviewed behavior changes or vulnerable releases. This is a supply-chain hygiene issue even if no active exploit is shown in this file.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

pydantic has published advisories, and without version pinning the actual installed version cannot be assessed. If the skill validates untrusted input, an affected version could expose denial-of-service or parsing issues depending on how models are used elsewhere in the codebase.

Content

No source excerpt is available for this finding.