巴娜房产信息

• Outcome: Review
• Latest audit: Jul 22, 2026 · 2:28 AM UTC
• Version: 1.0.0

Overview

This real-estate API skill is purpose-aligned, but it needs Review because it collects paid API credentials, saves them by default, and can send those credentials through command-line arguments and an environment-selected endpoint.

Install only if you are comfortable giving the skill your Bana AppID and SecureKey. Treat SecureKey as a paid-account secret, prefer one-time use with no saving when possible, avoid command-line or log exposure, and do not set BANA_REALESTATE_BASE_URL unless you fully trust the destination. Expect successful paid methods to charge 0.4 yuan per call after fee notice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'request' from os.environ.get (line 177, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            body = response.read().decode("utf-8")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

• Confidence: 91% confidence
• Finding: The outbound request target is derived from BANA_REALESTATE_BASE_URL, an environment variable, and is used directly for network access. In an agent or shared automation environment, a malicious or compromised environment can redirect requests to an attacker-controlled server, causing credential exfiltration because app_id and secure_key are included in every POST body.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill directs execution of a local Python script, uses network access, reads/writes saved credentials, and references environment-based configuration, but no explicit permissions are declared. That mismatch increases the chance that an agent or reviewer underestimates the skill’s capabilities, especially because it can persist secrets and make external requests.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill tells the agent to ask the user for AppID and SecureKey and save them for future use, but it does not require a clear warning at the point of collection that these are sensitive credentials and will be persisted. This can lead users to disclose reusable secrets without informed consent, and persistent storage increases the blast radius if the host or agent memory is later compromised.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Passing SecureKey on the command line exposes it to process listings, shell history, logs, debugging tools, and other local observers. In this skill, the risk is amplified because the command examples normalize this practice and combine it with credential persistence, making accidental secret leakage more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation states that user-provided AppID and SecureKey are saved by default for future use, but it does not require explicit opt-in consent before storing sensitive credentials locally. Default persistence of authentication secrets increases the chance of unintended retention, local compromise, or later misuse by other processes or users on the same system.

Credential Access

High

• Category: Privilege Escalation

Content

- 收费接口返回 `402` 余额不足：前往巴娜 Skill 技能中心 <https://wxpub.aibana.art> 充值。
- 普通用户无需配置环境变量或操作终端；没有已保存凭证时，智能体直接在对话中请求 AppID 和 SecureKey。
- 用户提供的凭证默认保存，供后续查询自动使用；用户明确要求不保存时，仅使用一次。
- 保存位置为当前用户配置目录下的 `bana-real-estate/credentials.json`，客户端会限制文件访问权限。
- 不要在后续答复中重复展示用户的 SecureKey。

## 方法与参数

• Confidence: 97% confidence
• Finding: The skill instructs the agent to solicit AppID and SecureKey in chat and store them in a local credentials.json file for reuse. This creates a real credential exposure risk because conversational collection plus filesystem persistence enlarges the attack surface: chat logs, local file access, backups, or other software could recover reusable secrets and abuse the paid API account.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.