Bimiyun Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Bimiyun web-search helper, but it has review-worthy risks around broad auto-invocation, third-party query transmission, and an unrestricted endpoint override that can expose the API key.

Install only if you are comfortable sending search terms to Bimiyun and you can control the runtime environment. Prefer BIMIYUN_API_KEY from a trusted secret store or environment variable, avoid --api-key in commands, do not put sensitive queries into searches, and do not set BIMIYUN_ENDPOINT unless you fully trust and intend that destination.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bimiyun_search.py:34

Finding

Unrestricted API endpoint override can disclose credentials and search queries

Content

View full analysis

Vulnerability Details

File Location: scripts/bimiyun_search.py, lines 34-53 and 62-101
Vulnerability Type: Arbitrary credential-bearing network destination
Risk Level: High

Vulnerable Code

python

def load_endpoint() -> str:
    """Load the Bimiyun Search API endpoint."""
    endpoint = os.environ.get("BIMIYUN_ENDPOINT")
    if endpoint:
        return endpoint.strip()

    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:
                txt = f.read()
            m = re.search(r"^\s*BIMIYUN_ENDPOINT\s*=\s*(.+?)\s*$", txt, re.M)
            if m:
                return m.group(1).strip().strip('"').strip("'")
        except Exception:
            pass

    return "https://search.bimiyun.com/api/web"

python

def __init__(self, api_key: Optional[str] = None, endpoint: Optional[str] = None):
    self.api_key = api_key or load_key()
    self.endpoint = endpoint or load_endpoint()

python

req = urllib.request.Request(
    self.endpoint,
    data=data,
    headers={
        "Content-Type": "application/json",
        "Accept": "application/json",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
        "X-Api-Key": self.api_key,
    },
    method="POST",
)

with urllib.request.urlopen(req, timeout=30) as resp:
    body = resp.read().decode("utf-8", errors="replace")

Technical Analysis

The request destination can be supplied through BIMIYUN_ENDPOINT, a local .env file, or the public BimiyunSearch constructor. The destination is used without validating its scheme, hostname, port, or ownership.

The same request includes the sensitive API key in the X-Api-Key header and the user's search query in the JSON body. Consequently, anyone who can influence the endpoint configuration ...[truncated 1632 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove endpoint configurability unless it is operationally required, and use the fixed official endpoint.
2. If endpoint customization is required, parse the URL and enforce:
   • The https scheme.
   • An explicit allowlist containing search.bimiyun.com.
   • The expected port.
   • No embedded user information, fragments, IP literals, or deceptive subdomains.
3. Reject redirects to a different origin and ensure the API-key header is never forwarded across host boundaries.
4. Do not silently accept endpoint configuration from an arbitrary working-directory .env file.
5. Separate development/test endpoint support from production builds and require explicit opt-in without production credentials.
6. Use scoped, revocable API keys and rotate any credential that may have been transmitted to an untrusted endpoint.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

API key exposure through documented command-line arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-32; scripts/bimiyun_search.py, line 147
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash

python scripts/bimiyun_search.py --query "How to learn Python" --api-key "your-key"

python

parser.add_argument("--api-key", help="Bimiyun Search API key")

Technical Analysis

The documentation recommends passing the API key directly as a command-line argument, and the implementation explicitly supports this method. Command-line arguments are not an appropriate secret-transport mechanism because they may be recorded in shell history, process execution telemetry, audit logs, diagnostic output, or automation logs. Depending on the operating system and process isolation settings, other local users may also be able to inspect process arguments while the command is running.

This exposure is unnecessary because the Skill already supports obtaining the credential from BIMIYUN_API_KEY. A protected secret store or non-echoing input mechanism would further reduce exposure.

Attack Path

1. A user follows the documented example and supplies a real API key through --api-key.
2. The complete command is stored in shell history, captured by terminal or execution telemetry, written to CI logs, or temporarily exposed through process inspection.
3. A local user, administrator, monitoring service, or person with access to those records retrieves the key.
4. The recovered key is used to make unauthorized requests to the Bimiyun API.

Impact Assessment

Exposure grants the attacker the API privileges associated with the compromised key. This may permit unauthorized searches, quota consumption, service charges, or other operations supported by that credential.

The issue does not itself provide operating-system privilege escalation. Its scope is the Bimiyun acc ...[truncated 60 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key option or clearly mark it as unsafe and deprecated.
2. Remove command-line examples that place secrets directly in shell commands.
3. Prefer a protected credential manager or the BIMIYUN_API_KEY environment variable supplied through the execution platform's secret-management facility.
4. For interactive use, accept the key through a non-echoing prompt such as Python's getpass.
5. Avoid reading secrets from untrusted working-directory files; if file-based configuration is retained, require restrictive file permissions and a predictable trusted path.
6. Advise users who previously supplied keys on the command line to clear relevant histories and logs and rotate exposed credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description contains very broad trigger phrases like '搜索', '查找', and similar common-language variants, which are likely to activate during ordinary conversation rather than only when the user explicitly intends to invoke this skill. Overbroad invocation increases the chance of unintended network requests and accidental disclosure of user queries to an external service.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

if key:
        return key.strip()

    # 从 .env 文件加载
    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

if key:
        return key.strip()

    # 从 .env 文件加载
    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bimiyun_search.py (reported line 24)May include surrounding context.

python

if key:
        return key.strip()

    # 从 .env 文件加载
    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bimiyun_search.py (reported line 45)May include surrounding context.

python

if key:
        return key.strip()

    # 从 .env 文件加载
    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bimiyun_search.py (reported line 25)May include surrounding context.

python

return key.strip()

    # 从 .env 文件加载
    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:
                txt = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bimiyun_search.py (reported line 27)May include surrounding context.

python

return key.strip()

    # 从 .env 文件加载
    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:
                txt = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bimiyun_search.py (reported line 46)May include surrounding context.

python

return key.strip()

    # 从 .env 文件加载
    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:
                txt = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bimiyun_search.py (reported line 48)May include surrounding context.

python

return key.strip()

    # 从 .env 文件加载
    if os.path.exists(".env"):
        try:
            with open(".env", "r", encoding="utf-8", errors="ignore") as f:
                txt = f.read()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises capabilities that involve environment variables and network access but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for a host system or reviewer to understand and constrain what the skill may access at runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Markdown documentation explains setup and use but does not clearly warn users that their search queries will be transmitted to an external third-party API. Without a prominent disclosure, users may unknowingly send sensitive prompts, personal data, or proprietary information off-platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill sends user-provided search queries, language/safety settings, and result parameters to an external service endpoint, which creates a privacy and data-governance risk if users are not clearly informed that their input leaves the local environment. In an agent skill context, users may assume queries are handled internally, so transmitting prompts or sensitive lookup terms to a third-party API can expose confidential information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file accesses a sensitive credential via the BIMIYUN_API_KEY environment variable and also reads a local .env file, but there is no visible warning, prompt, or disclosure to the user that credentials will be loaded from these locations. Access to sensitive environment variables is explicitly in scope for missing-warning findings on code files.

Content

No source excerpt is available for this finding.