Security audit

Bing Image Search Mcp

Security checks for vulnerabilities and agentic risk

Overview

This Bing image search skill appears purpose-aligned, but it asks users to run unpinned third-party packages and silently falls back to a shared demo gateway key.

Review before installing. Use an isolated environment, avoid global npm installs, pin and verify dependency versions, provide your own least-privilege OneKey key, and do not submit sensitive or regulated data as image search queries.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned Third-Party Runtime Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/search_images.py:8
Finding: Hard-Coded Shared Fallback API Credential
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes capabilities involving environment-variable access and file reading but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for users or orchestrators to understand and constrain what the skill may access at runtime.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to provide an API key and even references a fallback demo key, but it does not clearly disclose that user queries are transmitted to external services through OneKey Gateway and Bing. This creates a privacy and data-handling transparency issue, especially if users submit sensitive prompts assuming the processing is local.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: Using npx onekey without pinning a specific package version allows execution of whatever version is current at install time. This creates supply-chain risk because behavior can change unexpectedly or a compromised upstream release could be pulled and executed by users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This invocation again relies on an unpinned npx onekey command, which fetches and executes code without a fixed version guarantee. Repeated examples normalize unsafe installation and increase the chance that users run an unexpected or malicious package version.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code forwards the entire user-supplied payload to an external router via router.invoke, which is a network-facing operation. The file contains no confirmation prompt, comment, docstring, or user-facing notice explaining that input data will be transmitted off-process/off-host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code invokes a remote router with the full payload, which may transmit user-supplied query data over the network. While the CLI description names the tool, there is no explicit comment, docstring, or user-facing notice warning that input data will be sent to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script falls back to a hardcoded router access key when the environment variable is absent, embedding what appears to be a usable credential directly in code. Hardcoded secrets are dangerous because they can be extracted from source control or redistributed packages, enabling unauthorized use of the external service and making key rotation and access control difficult.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.