Skill Trust Decision
子网计算服务
Skill presents as an IPv4 subnet calculator but contains documented evidence of being a repurposed gaokao/school service, with undeclared network access and filesystem write operations.
Most direct threat evidence
01
Skill presents itself as a subnet calculator via SKILL.md, masking its origins as a gaokao service Entry · SKILL.md
02
Asks user for API key via AskUserQuestion — legitimate credential gathering social · SKILL.md
03
Writes API key to .env in plaintext (undeclared filesystem:WRITE) Persistence · scripts/config.py
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
4 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
4 dependency or supply-chain issues need attention.
Attack Chain
01
Skill presents itself as a subnet calculator via SKILL.md, masking its origins as a gaokao service
Entry · SKILL.md:1
02
Asks user for API key via AskUserQuestion — legitimate credential gathering
social · SKILL.md:15
03
Writes API key to .env in plaintext (undeclared filesystem:WRITE)
Persistence · scripts/config.py:29
04
Sends subnet/IP parameters and user API key to https://mcp.xiaobenyang.com/api (undeclared network access)
Exfiltration · scripts/call_api.py:64
What drove the risk score up
Documentation deception — repurposed from unrelated gaokao service +20
SKILL.md describes subnet planning, but config.py class docstring says '小笨羊高考Skill配置' (Gaokao skill config), env_prefix is 'XBY_GAOKAO_', and project structure references 'xiaobenyang_gaokao_skill/'. The skill-card explicitly acknowledges 'leftover references to an unrelated gaokao or school service' as a known risk.
Undeclared network access +20
SKILL.md only declares AskUserQuestion as the tool. No network resource is declared in allowed-tools, yet the implementation silently POSTs subnet/IP parameters to https://mcp.xiaobenyang.com/api with the user's API key in headers.
Undeclared filesystem WRITE +5
config.py:save_api_key_to_env() writes the user-provided API key to a .env file. SKILL.md does not declare filesystem:WRITE permission.
Unpinned dependencies +5
requirements.txt uses '>= ' for all four dependencies, allowing arbitrary version upgrades from PyPI.
Most important evidence
High Doc Mismatch
Skill repurposed from unrelated gaokao/school service
SKILL.md describes an IPv4 subnet calculator, but the code contains clear evidence of being modified from a 'gaokao' (Chinese college entrance exam) service. config.py class docstring is '小笨羊高考Skill配置', env_prefix is 'XBY_GAOKAO_', and SKILL.md's project structure references 'xiaobenyang_gaokao_skill/'. The skill-card.md explicitly acknowledges this as a known risk. The intent and provenance of the skill is unclear.
scripts/config.py:13 Reject deployment until provenance is verified. A legitimate skill should not have a completely different service baked into its configuration.
High Priv Escalation
Undeclared network access to third-party API
SKILL.md declares no network resource access and lists only AskUserQuestion as a tool. However, all five tool functions in tools.py silently call the xiaobenyang.com MCP API, sending the user's API key and potentially sensitive network topology data (IPs, subnets, CIDR prefixes) to https://mcp.xiaobenyang.com. The SKILL.md never mentions this API call or network access.
scripts/call_api.py:64 SKILL.md must declare network:READ or network:WRITE in allowed-tools. Users must be explicitly informed that subnet/IP data is transmitted to xiaobenyang.com.
Medium Credential Theft
API key stored in plaintext on filesystem
User-provided API key is written to .env in plaintext via config.py:save_api_key_to_env(). This file could be committed to version control or read by other processes. The skill-card.md acknowledges this as a known risk ('install only when the provider is trusted').
scripts/config.py:29 Use a secrets manager or OS-level credential storage instead of plaintext .env files.
Medium Supply Chain
All dependencies use unpinned >= versions
requirements.txt specifies 'requests>=2.31.0', 'pydantic>=2.7.0', 'pydantic-settings>=2.2.0', and 'python-dotenv>=1.0.1', allowing arbitrary version upgrades from PyPI.
requirements.txt:1 Pin all dependencies to exact versions (e.g., requests==2.31.0) to prevent supply chain attacks via dependency upgrades.
Low Doc Mismatch
Incorrect project structure reference in SKILL.md
SKILL.md's project structure block references 'xiaobenyang_gaokao_skill/' as the root directory, which is a leftover artifact inconsistent with the subnet calculator branding.
SKILL.md:75 Update to reflect the actual package name.
Declared capability vs actual capability
Network Block
Declared NONE
→ Inferred READ
SKILL.md declares no network access; call_api.py:64 POSTs to https://mcp.xiaobenyang.com/api Filesystem Block
Declared NONE
→ Inferred WRITE
config.py:29 save_api_key_to_env() writes XBY_APIKEY to .env Shell Pass
Declared NONE
→ Inferred NONE
No shell command execution found Environment Pass
Declared NONE
→ Inferred READ
config.py:37 reads os.getenv('XBY_APIKEY') Skill Invoke Pass
Declared NONE
→ Inferred NONE
No recursive skill invocation Clipboard Pass
Declared NONE
→ Inferred NONE
No clipboard access Browser Pass
Declared NONE
→ Inferred NONE
No browser automation Database Pass
Declared NONE
→ Inferred NONE
No database access Suspicious artifacts and egress
Medium External URL
https://xiaobenyang.com SKILL.md:19
Medium External URL
https://mcp.xiaobenyang.com scripts/config.py:19
Medium External URL
https://clawhub.ai/user/alinklab skill-card.md:7
Medium External URL
https://clawhub.ai/alinklab/subnet-calculator skill-card.md:27
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| requests | >=2.31.0 | pip | No | Version not pinned |
| pydantic | >=2.7.0 | pip | No | Version not pinned |
| pydantic-settings | >=2.2.0 | pip | No | Version not pinned |
| python-dotenv | >=1.0.1 | pip | No | Version not pinned |
File composition
8 files · 520 lines
Python 4 files · 328 linesMarkdown 2 files · 184 linesJSON 1 files · 5 linesText 1 files · 3 lines
Files of concern · 5
SKILL.md Incorrect project structure reference in SKILL.md · https://xiaobenyang.com
scripts/call_api.py Undeclared network access to third-party API
scripts/config.py Skill repurposed from unrelated gaokao/school service · API key stored in plaintext on filesystem · https://mcp.xiaobenyang.com
skill-card.md https://clawhub.ai/user/alinklab · https://clawhub.ai/alinklab/subnet-calculator
requirements.txt All dependencies use unpinned >= versions
Other files · tools.py · _meta.json · __init__.py
Security positives
No reverse shell, C2, or reverse connection behavior detected
No base64 or other code obfuscation observed
No access to ~/.ssh, ~/.aws, .env (as a source), or other sensitive paths
No eval(), exec(), or dynamic code execution
No cron jobs, startup hooks, or persistence mechanisms
skill-card.md acknowledges the gaokao reference mismatch and API key risk, showing publisher awareness
Network calls are structurally standard HTTP (not DNS-over-HTTPS tunneling or custom protocols)