Security audit

search1api

Security checks for vulnerabilities and agentic risk

Overview

This web-search skill is mostly purpose-aligned, but its install instructions and data-sharing defaults need human review before use.

Review before installing. Prefer the connected MCP tool or a verified, pinned CLI installation over the curl-to-bash or unpinned global npm commands. Do not submit secrets, signed URLs, private/internal links, regulated data, or confidential research terms unless you are comfortable sending them to Search1API and any selected search provider. Use browser login rather than pasting API keys where possible, and keep keys out of chat, logs, and shell history.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:24
Finding: Unverified Remote Installer Executed Directly by Bash
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unpinned Global npm Package Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:66
Finding: Automatic External Submission of Potentially Sensitive URLs and Queries
Content: View full analysis
` | | Wants to search the web | `search` | `s1 search ""` | | Wants the full page behind a search result | `fetch` with its result `id` | `s1 crawl ` | | Wants news | `news` | `s1 news ""` | | Wants to explore a site's links | `sitemap` | `s1 sitemap ` | ``` The behavior is also reinforced by the declaration that a bare URL should trigger the Skill and by examples such as: ```bash s1 crawl https://example.com/blog-post ``` ### Technical Analysis The Skill sends user-supplied queries and URLs to Search1API through either its remote MCP service or CLI. External transmission is necessary for the declared hosted search and crawling functionality, but the instructions do not require a sensitivity assessment, redaction, or user confirmation before sending the data. A complete URL can contain signed access parameters, bearer tokens, session identifiers, document IDs, private hostnames, or confidential search terms. Automatically treating a bare URL as a crawl request creates a risk that these values will be disclosed to a third-party processor. The same concern applies to research queries containing confidential project, customer, medical, legal, or security information. No evidence was found that the Skill intentionally exfiltrates configured API keys. The confirmed issue is the absence of safeguards around expected external submission of user-provided content. ### Attack Path 1. A user provides a URL containing a secret, signed query parameter, private hostname, or sensitive resource identifier. 2. The Skill's bare-URL trigger selects the crawl workflow. 3. The full URL is passed to the ...[truncated 727 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill recommends installing software by piping a remote script directly into bash. This pattern bypasses review of the downloaded content and creates a direct remote-code-execution path if the server, distribution channel, or network path is compromised.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
server or install the CLI:

bash
curl -fsSL https://cli.search1api.com/install.sh | bash

Or via npm:

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The explicit use of | bash creates a command-chaining pattern that immediately executes untrusted remote content. In an agent or assisted environment, this is especially dangerous because it normalizes one-step execution of code the user and system have not inspected.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
server or install the CLI:

bash
curl -fsSL https://cli.search1api.com/install.sh | bash

Or via npm:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill routes user queries, URLs, and page retrieval requests to Search1API, but it does not instruct the agent to warn the user that this data will be transmitted to an external third-party service. In contexts involving sensitive links, internal URLs, or private research topics, this can create an avoidable privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is configured to trigger on very broad phrases like general web lookup, news, URL sharing, and common research requests. This can cause the agent to invoke the skill in many ordinary conversations, increasing the chance that user data or URLs are unnecessarily sent to an external service without clear user intent or informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation instructs the agent to use Baidu for Chinese queries by default rather than presenting it as an optional engine choice. That creates a routing decision based on language without user consent, which can have privacy, compliance, and trust implications depending on the user's jurisdiction and the sensitivity of the searched content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill includes instructions to set API keys manually and via environment variable, but it does not warn about safe credential handling. This increases the risk that users expose secrets in shell history, shared terminals, logs, screenshots, or by pasting keys directly into chats or commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The examples encourage sending user queries and URLs to third-party search and crawling services without any disclosure, consent, or privacy warning. In a web-search skill this is expected behavior, but failing to note the external data transfer can still expose sensitive prompts, internal URLs, or private research topics to outside providers.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.