Security audit

AnySearch

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real search skill, but its clients can be redirected to send API keys and queries to an unexpected endpoint.

Review before installing. Use anonymous mode or a low-privilege AnySearch key, avoid passing keys with --api_key, prefer environment-variable or protected secret storage, and do not use the skill with sensitive queries. Ensure ANYSEARCH_API_BASE_URL is unset and that no skill-local .env file can override it before running authenticated searches.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/anysearch_cli.py:50
Finding: Bearer credentials and sensitive requests can be redirected to an arbitrary endpoint
Content: View full analysis
dict: headers = { "Content-Type": "application/json", "X-Anysearch-Client": CLIENT_HEADER, } if api_key: headers["Authorization"] = f"Bearer {api_key}" return headers def _call_rest(method: str, path: str, api_key: str, *, payload=None, params=None) -> dict: try: resp = requests.request( method, f"{API_BASE_URL}{path}", json=payload, params=params, headers=_build_headers(api_key), timeout=30, ) ``` The Node.js implementation additionally demonstrates that plaintext HTTP is explicitly supported: ```javascript const API_BASE_URL = (process.env.ANYSEARCH_API_BASE_URL || "https://api.anysearch.com").replace(/\/$/, ""); function restRequest(method, endpointPath, apikey, payload = undefined, params = []) { const urlObj = new URL(API_BASE_URL + endpointPath); const options = { hostname: urlObj.hostname, port: urlObj.port || undefined, path: urlObj.pathname + urlObj.search, method, headers: { "Content-Type": "application/json", "X-Anysearch-Client": CLIENT_HEADER, }, }; if (apikey) { options.headers["Authorization"] = `Bearer ${apikey}`; } return new Promise((resolve, reject) => { const transport = urlObj.protocol === "http:" ? http : https; const req = transport.request(options, (res) => { ``` The shell implemen ...[truncated 3330 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Python dependency installation is not reproducible or integrity-pinned
Content: View full analysis
=2.20 ``` The Skill instructions also recommend installing the dependency dynamically: ```markdown - Dependency: the `requests` library (not part of the standard library). It is commonly already available; if importing it fails, install with `pip install requests` (or `pip install -r requirements.txt`), or fall through to the Node.js CLI, which has no dependencies. ``` ### Technical Analysis The Python dependency is specified only with a broad lower bound: ```text requests>=2.20 ``` There is no exact version, upper compatibility bound, lock file, or package hash. Consequently, installation results depend on the state of the package index at installation time rather than on the audited project contents. The direct package name is legitimate and no typosquatting or dependency-confusion package was identified. Nevertheless, the current instructions permit an agent to install unaudited future versions and their transitive dependencies. Python package installation can execute build backend and installation-related code with the permissions of the invoking user. This is a supply-chain hardening deficiency rather than evidence that the current `requests` package is malicious. ### Attack Path 1. The selected Python runtime does not already contain `requests`. 2. The agent follows `SKILL.md:158` and executes: ```bash pip install requests ``` or: ```bash pip install -r requirements.txt ``` 3. pip resolves the latest version satisfying `requests>=2.20`, together with dynamically selected transitive depen ...[truncated 1118 chars]
Remediation: View remediation
--hash=sha256: ``` 4. Document a controlled update process that reviews new direct and transitive dependency versions before changing the lock file. 5. Prefer an already available dependency-free runtime, such as the bundled Node.js client, instead of instructing an agent to install packages automatically. 6. If installation is necessary, require user confirmation and use an isolated virtual environment rather than modifying the global Python environment. 7. Add automated dependency vulnerability and integrity checks to release CI. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (59)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .env.example (reported line 6)May include surrounding context.
text
.env runtime.conf __pycache__ .idea

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 1)May include surrounding context.
text
.env runtime.conf __pycache__ .idea

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 109)May include surrounding context.
Copy the example env file and fill in your key:

bash
cp .env.example .env # Edit .env and set: ANYSEARCH_API_KEY=<your_api_key_here>

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documentation instructs storing an API key in a plaintext .env file. Although common, this increases the chance of accidental exposure through local file access, backups, logs, or misconfigured tooling, especially in shared agent environments.
Content: Scanner excerpt · README_zh.md (reported line 109)May include surrounding context.
复制示例环境变量文件并填入你的 key：

bash
cp .env.example .env # 编辑 .env 并设置：ANYSEARCH_API_KEY=<your_api_key_here>

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the skill package also contains local test-server and multi-runtime subprocess test functionality, that materially exceeds the declared end-user search purpose. In environments where skills are trusted based on description, hidden testing/subprocess behavior expands attack surface and may enable unexpected local execution paths, network listeners, or command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill package also contains local test-server and multi-runtime subprocess test functionality, that materially exceeds the declared end-user search purpose. In environments where skills are trusted based on description, hidden testing/subprocess behavior expands attack surface and may enable unexpected local execution paths, network listeners, or command invocation.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill explicitly handles an API key from .env, environment variables, or CLI flags, which confirms credential access capability. This is risky in a skill that also performs network operations and shell invocation, because mishandling could expose secrets via process arguments, logs, error messages, or unintended downstream requests.
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
- name: ANYSEARCH_API_KEY required: false description: "API key for higher rate limits. Anonymous access available with lower rate limits." storage: ".env file, environment variable, or --api_key CLI flag" --- ## Overview

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The documented key source priority explicitly prefers a CLI flag over .env and environment variables, which is a poor security default because command-line arguments are often visible to other local users, shell history, monitoring agents, and crash reports. The skill context makes this more dangerous because the tool is designed for routine use and could normalize insecure secret-passing practices.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
Key Source Priority

text
--api_key CLI flag > .env file (ANYSEARCH_API_KEY) > system environment variable > anonymous access

Anonymous access is available with lower rate limits. An API Key is optional but recommended for higher rate limits. If no key is found, the agent may proceed with anonymous access. If the user wants higher limits, guide them to configure a key securely.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill instructs the agent to persist a newly received API key into a local .env file after user confirmation. Even with confirmation, automatic secret persistence expands the blast radius of compromise because .env files may have weak filesystem protections, be accidentally committed to source control, or be readable by other local tools and sessions.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
When a new key is obtained via auto-registration, the agent MUST: 1. Ask the user for explicit confirmation before saving the key to disk. 2. Inform the user: "A new API key was received. Save it to .env for future use?" 3. Only after user approval, update the `.env` file. 4. Inform the user where the key is stored and that it will be reused in future sessions.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.
md
| Linux / macOS | bash 3.2+ (with `jq` and `curl`) | `anysearch_cli.sh` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
md
| Linux / macOS | bash 3.2+ (with `jq` and `curl`) | `anysearch_cli.sh` |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.js (reported line 22)May include surrounding context.
js
$SCRIPT_DIR = Split-Path -Parent $MyInvocation.MyCommand.Definition function Load-Env { $envPaths = @((Join-Path $SCRIPT_DIR ".env"), (Join-Path (Join-Path $SCRIPT_DIR "..") ".env")) foreach ($envPath in $envPaths) { if (Test-Path $envPath) { Get-Content $envPath -Encoding UTF8 | ForEach-Object {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.ps1 (reported line 13)May include surrounding context.
text
$SCRIPT_DIR = Split-Path -Parent $MyInvocation.MyCommand.Definition function Load-Env { $envPaths = @((Join-Path $SCRIPT_DIR ".env"), (Join-Path (Join-Path $SCRIPT_DIR "..") ".env")) foreach ($envPath in $envPaths) { if (Test-Path $envPath) { Get-Content $envPath -Encoding UTF8 | ForEach-Object {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.py (reported line 29)May include surrounding context.
python
$SCRIPT_DIR = Split-Path -Parent $MyInvocation.MyCommand.Definition function Load-Env { $envPaths = @((Join-Path $SCRIPT_DIR ".env"), (Join-Path (Join-Path $SCRIPT_DIR "..") ".env")) foreach ($envPath in $envPaths) { if (Test-Path $envPath) { Get-Content $envPath -Encoding UTF8 | ForEach-Object {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.sh (reported line 33)May include surrounding context.
sh
$SCRIPT_DIR = Split-Path -Parent $MyInvocation.MyCommand.Definition function Load-Env { $envPaths = @((Join-Path $SCRIPT_DIR ".env"), (Join-Path (Join-Path $SCRIPT_DIR "..") ".env")) foreach ($envPath in $envPaths) { if (Test-Path $envPath) { Get-Content $envPath -Encoding UTF8 | ForEach-Object {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 110)May include surrounding context.
md
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 254)May include surrounding context.
md
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README_zh.md (reported line 110)May include surrounding context.
md
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README_zh.md (reported line 254)May include surrounding context.
md
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.js (reported line 37)May include surrounding context.
js
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.ps1 (reported line 30)May include surrounding context.
text
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.py (reported line 19)May include surrounding context.
python
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.py (reported line 22)May include surrounding context.
python
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.py (reported line 24)May include surrounding context.
python
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anysearch_cli.py (reported line 25)May include surrounding context.
python
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace") def _load_env(): """Load API keys from .env files near the skill. The documented priority is: --api_key > .env file > environment variable > anonymous.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Tp4

Tp4

Credential Access

Credential Access

Key Source Priority

Credential Access

Ae1

Ae1

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis