日常物体检测

• Outcome: Review
• Latest audit: Jul 9, 2026 · 10:02 PM UTC
• Version: 1.0.0

Overview

The skill likely performs object detection, but it asks for and stores an API key, sends image data to an external service, and contains mismatched Gaokao configuration artifacts that warrant review.

Install only if you trust xiaobenyang.com with both your API key and the images you submit. Avoid sensitive photos, inspect or remove the Gaokao leftovers before relying on it, and prefer storing the API key in a managed secret store rather than a plaintext .env file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation indicates capabilities to read environment variables, write files, and make network requests, yet no permissions are declared. This creates a transparency and governance gap: the skill can persist secrets locally and exfiltrate user-provided image data or metadata to remote services without an explicit permission boundary. In a skill that handles API keys and image inputs, undeclared capabilities materially increase the risk of secret handling and external data transfer occurring without informed review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose is narrow object detection, but the skill also instructs the model to collect, read, and persist API keys and references generic API-calling infrastructure beyond the user-facing description. This mismatch is dangerous because users may provide images expecting simple detection while the skill also performs undisclosed secret management and broader remote invocation behavior, undermining informed consent and increasing abuse surface. The presence of local secret storage and generic remote-call plumbing makes the hidden behavior more sensitive in context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill is described as simple image object detection, but this code performs arbitrary outbound requests to an external MCP endpoint using caller-controlled tool names and parameters. That creates a capability mismatch: users may believe processing is local or narrowly scoped, while the skill can invoke unrelated remote functionality and transmit data off-host, increasing the risk of data exfiltration, unauthorized actions, or hidden remote dependency abuse.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code retrieves an external API key and uses it for outbound network calls, which is not obviously necessary for a skill advertised as ordinary object detection. In this context, the hidden credentialed remote access expands the trust boundary and could let the skill send user data to a third party or invoke privileged upstream capabilities without clear user awareness.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file’s behavior and identifiers clearly target a different skill domain than the declared image object detection purpose: it references a gaokao skill, remote MCP service identifiers, and API-key management. This mismatch is a strong supply-chain red flag because the package asks for and persists credentials unrelated to the advertised functionality, indicating hidden or undeclared capability.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This code stores and manages API credentials even though the declared skill only performs local-style object detection on images. Persisting secrets for an unrelated capability expands the attack surface and enables unauthorized remote access or later exfiltration, especially when the credential feature is hidden from the stated skill purpose.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The docstring and comments explicitly describe a gaokao/API-key setup rather than an object-detection skill, confirming a material mismatch between declared and actual intent. Such contradictory metadata is dangerous because it can conceal hidden functionality and mislead reviewers or users into granting trust and credentials they would not otherwise provide.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill asks users for image URLs or base64-encoded image data but does not warn that this content will be transmitted to an external API for processing. This is a meaningful privacy issue because images may contain people, homes, license plates, or other sensitive content, and users are not clearly informed of the third-party transfer before submission. In the context of image analysis, undisclosed outbound sharing is more dangerous than in a purely local skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function writes the API key directly into a local .env file without any user-facing warning, consent, or explanation of persistence. This is unsafe because .env files are commonly left with broad file access, accidentally committed, or exposed through logs/backups, causing credential leakage.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function sends a user-supplied image URL to an external API via call_api, but this file provides no disclosure, consent flow, or indication that image data may leave the local environment. Because images can contain sensitive personal or environmental information, silent transmission to a third party creates a real privacy and data-handling risk even if the functionality is expected for the skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This function transmits raw base64-encoded image content to an external API without any visible warning or consent mechanism in the code path. Base64 content may include full sensitive images, making the privacy exposure more direct than a URL-only reference and increasing the risk of unintentional third-party data disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 94% confidence
• Finding: The code forcibly reads .env and extracts XBY_APIKEY outside normal settings flow, specifically targeting a credential unrelated to the declared object-detection skill. In context, this is dangerous because it intentionally accesses secrets for hidden functionality, increasing the likelihood of unauthorized credential use.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 94% confidence
• Finding: This .env access is part of a deliberate credential-reading path that seeks a specific API key for an undeclared service. Because the skill advertises image detection but reads secrets for another domain, the behavior is suspicious and can enable unauthorized use of user credentials.

Credential Access

High

• Category: Privilege Escalation

Content

if line.startswith("XBY_APIKEY="):
                    self.api_key = line.split("=", 1)[1].strip()
                    break
        # 如果环境变量有值，覆盖 .env 的值
        env_val = os.getenv("XBY_APIKEY", "")
        if env_val:
            self.api_key = env_val

• Confidence: 91% confidence
• Finding: Reading XBY_APIKEY from the process environment is normal in isolation, but within this mismatched skill it contributes to accessing credentials for an unrelated service. The context makes the behavior unsafe because it broadens the places from which hidden functionality can source secrets without transparent user awareness.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 93% confidence
• Finding: This function is explicitly designed to save an API key into .env, creating long-lived local credential exposure. Persisting secrets in plaintext is a common source of compromise through source-control mistakes, backups, shared directories, or overly permissive file access.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 92% confidence
• Finding: The function advertises that it will persist an API key to .env, reinforcing that the skill contains undeclared credential-management capability. In the context of an object-detection skill, this hidden persistence is unnecessary and raises the risk of credential misuse or leakage.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 91% confidence
• Finding: The dependency is version-ranged rather than pinned, which makes builds non-reproducible and can introduce unexpected or vulnerable upstream releases during installation. In a skill that may be deployed repeatedly across environments, this increases supply-chain risk even though the line itself is not directly exploitable code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 88% confidence
• Finding: Using pydantic with a >= specifier allows future releases to be installed without review, which can break behavior or pull in vulnerable versions. This is a supply-chain hygiene issue rather than an application-logic flaw, but it is still a real security weakness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 88% confidence
• Finding: An unpinned pydantic-settings dependency permits uncontrolled upgrades, reducing reproducibility and potentially introducing insecure or incompatible versions. While the package choice is common and not suspicious by itself, the lack of pinning weakens supply-chain control.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 90% confidence
• Finding: python-dotenv is also unpinned, so fresh installs may resolve to different package versions over time, including versions with newly introduced flaws. Because dotenv libraries often interact with configuration and secrets, uncontrolled version drift is a meaningful security concern.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The requirements allow requests>=2.31.0, and static analysis identifies requests 2.31.0 as having published advisories, so environments may install a vulnerable version. In a skill that likely performs network access for image handling or inference integration, flaws in HTTP request handling can expose credentials, weaken TLS/session validation, or otherwise compromise outbound communications.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: The dependency set permits python-dotenv 1.0.1, which static analysis flags for a symlink-following arbitrary file overwrite issue in set_key. This is only likely exploitable if the skill or its tooling writes dotenv files via affected APIs, so the contextual danger is lower for an object-detection skill unless environment management features are present elsewhere.

Static analysis

No suspicious patterns detected.