安全决策报告
子网计算服务
Skill presents as an IPv4 subnet calculator but contains documented evidence of being a repurposed gaokao/school service, with undeclared network access and filesystem write operations.
最直接的威胁证据
01
Skill presents itself as a subnet calculator via SKILL.md, masking its origins as a gaokao service 初始入口 · SKILL.md
02
Asks user for API key via AskUserQuestion — legitimate credential gathering social · SKILL.md
03
Writes API key to .env in plaintext (undeclared filesystem:WRITE) 持久化 · scripts/config.py
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 2 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 4 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 4 步攻击链，另有 2 项高危或严重发现。
复核
依赖与供应链卫生
发现 4 项需要关注的依赖或供应链线索。
攻击链
01
Skill presents itself as a subnet calculator via SKILL.md, masking its origins as a gaokao service
初始入口 · SKILL.md:1
02
Asks user for API key via AskUserQuestion — legitimate credential gathering
social · SKILL.md:15
03
Writes API key to .env in plaintext (undeclared filesystem:WRITE)
持久化 · scripts/config.py:29
04
Sends subnet/IP parameters and user API key to https://mcp.xiaobenyang.com/api (undeclared network access)
数据外泄 · scripts/call_api.py:64
风险分是怎么被拉高的
Documentation deception — repurposed from unrelated gaokao service +20
SKILL.md describes subnet planning, but config.py class docstring says '小笨羊高考Skill配置' (Gaokao skill config), env_prefix is 'XBY_GAOKAO_', and project structure references 'xiaobenyang_gaokao_skill/'. The skill-card explicitly acknowledges 'leftover references to an unrelated gaokao or school service' as a known risk.
Undeclared network access +20
SKILL.md only declares AskUserQuestion as the tool. No network resource is declared in allowed-tools, yet the implementation silently POSTs subnet/IP parameters to https://mcp.xiaobenyang.com/api with the user's API key in headers.
Undeclared filesystem WRITE +5
config.py:save_api_key_to_env() writes the user-provided API key to a .env file. SKILL.md does not declare filesystem:WRITE permission.
Unpinned dependencies +5
requirements.txt uses '>= ' for all four dependencies, allowing arbitrary version upgrades from PyPI.
最关键的证据
高危 文档欺骗
Skill repurposed from unrelated gaokao/school service
SKILL.md describes an IPv4 subnet calculator, but the code contains clear evidence of being modified from a 'gaokao' (Chinese college entrance exam) service. config.py class docstring is '小笨羊高考Skill配置', env_prefix is 'XBY_GAOKAO_', and SKILL.md's project structure references 'xiaobenyang_gaokao_skill/'. The skill-card.md explicitly acknowledges this as a known risk. The intent and provenance of the skill is unclear.
scripts/config.py:13 Reject deployment until provenance is verified. A legitimate skill should not have a completely different service baked into its configuration.
高危 权限提升
Undeclared network access to third-party API
SKILL.md declares no network resource access and lists only AskUserQuestion as a tool. However, all five tool functions in tools.py silently call the xiaobenyang.com MCP API, sending the user's API key and potentially sensitive network topology data (IPs, subnets, CIDR prefixes) to https://mcp.xiaobenyang.com. The SKILL.md never mentions this API call or network access.
scripts/call_api.py:64 SKILL.md must declare network:READ or network:WRITE in allowed-tools. Users must be explicitly informed that subnet/IP data is transmitted to xiaobenyang.com.
中危 凭证窃取
API key stored in plaintext on filesystem
User-provided API key is written to .env in plaintext via config.py:save_api_key_to_env(). This file could be committed to version control or read by other processes. The skill-card.md acknowledges this as a known risk ('install only when the provider is trusted').
scripts/config.py:29 Use a secrets manager or OS-level credential storage instead of plaintext .env files.
中危 供应链
All dependencies use unpinned >= versions
requirements.txt specifies 'requests>=2.31.0', 'pydantic>=2.7.0', 'pydantic-settings>=2.2.0', and 'python-dotenv>=1.0.1', allowing arbitrary version upgrades from PyPI.
requirements.txt:1 Pin all dependencies to exact versions (e.g., requests==2.31.0) to prevent supply chain attacks via dependency upgrades.
低危 文档欺骗
Incorrect project structure reference in SKILL.md
SKILL.md's project structure block references 'xiaobenyang_gaokao_skill/' as the root directory, which is a leftover artifact inconsistent with the subnet calculator branding.
SKILL.md:75 Update to reflect the actual package name.
声明能力 vs 实际能力
网络访问 阻止
声明 NONE
→ 推断 READ
SKILL.md declares no network access; call_api.py:64 POSTs to https://mcp.xiaobenyang.com/api 文件系统 阻止
声明 NONE
→ 推断 WRITE
config.py:29 save_api_key_to_env() writes XBY_APIKEY to .env 命令执行 通过
声明 NONE
→ 推断 NONE
No shell command execution found 环境变量 通过
声明 NONE
→ 推断 READ
config.py:37 reads os.getenv('XBY_APIKEY') 技能调用 通过
声明 NONE
→ 推断 NONE
No recursive skill invocation 剪贴板 通过
声明 NONE
→ 推断 NONE
No clipboard access 浏览器 通过
声明 NONE
→ 推断 NONE
No browser automation 数据库 通过
声明 NONE
→ 推断 NONE
No database access 可疑产物与外联
中危 外部 URL
https://xiaobenyang.com SKILL.md:19
中危 外部 URL
https://mcp.xiaobenyang.com scripts/config.py:19
中危 外部 URL
https://clawhub.ai/user/alinklab skill-card.md:7
中危 外部 URL
https://clawhub.ai/alinklab/subnet-calculator skill-card.md:27
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| requests | >=2.31.0 | pip | 否 | Version not pinned |
| pydantic | >=2.7.0 | pip | 否 | Version not pinned |
| pydantic-settings | >=2.2.0 | pip | 否 | Version not pinned |
| python-dotenv | >=1.0.1 | pip | 否 | Version not pinned |
文件构成
8 个文件 · 520 行
Python 4 个文件 · 328 行Markdown 2 个文件 · 184 行JSON 1 个文件 · 5 行Text 1 个文件 · 3 行
需关注文件 · 5
SKILL.md Incorrect project structure reference in SKILL.md · https://xiaobenyang.com
scripts/call_api.py Undeclared network access to third-party API
scripts/config.py Skill repurposed from unrelated gaokao/school service · API key stored in plaintext on filesystem · https://mcp.xiaobenyang.com
skill-card.md https://clawhub.ai/user/alinklab · https://clawhub.ai/alinklab/subnet-calculator
requirements.txt All dependencies use unpinned >= versions
其他文件 · tools.py · _meta.json · __init__.py
安全亮点
No reverse shell, C2, or reverse connection behavior detected
No base64 or other code obfuscation observed
No access to ~/.ssh, ~/.aws, .env (as a source), or other sensitive paths
No eval(), exec(), or dynamic code execution
No cron jobs, startup hooks, or persistence mechanisms
skill-card.md acknowledges the gaokao reference mismatch and API key risk, showing publisher awareness
Network calls are structurally standard HTTP (not DNS-over-HTTPS tunneling or custom protocols)