Moark Web Search

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward web-search helper that sends user queries to a documented Gitee AI endpoint, with no hidden local data access, persistence, or privilege escalation found.

Install this only if you trust the Gitee AI web-search service and are comfortable sending your search queries to it. Prefer setting `GITEEAI_API_KEY` in a protected environment rather than using `--api-key`, and install dependencies in a virtual environment with pinned versions when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19
Vulnerability Type: Unpinned Python dependency
Risk Level: Medium

Vulnerable Code:

bash

pip install requests

Technical Analysis

The installation instructions retrieve requests without specifying an audited version or verifying an integrity hash. Consequently, installation is not reproducible, and the code installed in the future may differ from the version evaluated during this audit.

This creates supply-chain exposure if a future release is compromised, an upstream distribution account or package repository is breached, or an incompatible release introduces exploitable behavior. The package name itself is legitimate and no current compromise is established; exploitation depends on a malicious or vulnerable package version being distributed through the selected package index.

Attack Path

1. An attacker compromises the upstream package, its publication account, or the package-distribution channel.
2. The attacker publishes a malicious version that remains compatible with the unrestricted installation requirement.
3. A user follows the documented pip install requests command.
4. The package manager selects and installs the malicious release.
5. Package installation or subsequent import executes attacker-controlled code with the privileges of the user running the Skill.

Impact Assessment

Successful exploitation could execute arbitrary Python code under the installing or executing user's account. This may expose the GITEEAI_API_KEY, search queries, accessible files, and other environment variables. If installation is performed from an elevated shell, the impact could extend to system-level modification. The project does not itself request elevation, persistence, or additional privileges.

Remediation

View remediation

Remediation Suggestions

• Pin requests to a reviewed version or tightly controlled version range.
• Maintain dependencies in a lock file or requirements file with cryptographic hashes.
• Install with hash verification, such as pip install --require-hashes -r requirements.txt.
• Use a trusted package index explicitly and review dependency updates before deployment.
• Run installation and the Skill under a non-privileged account in an isolated virtual environment.
• Add automated vulnerability and dependency-integrity scanning to the release process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/perform_web_search.py:72

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:21-27, scripts/perform_web_search.py:72-74
Vulnerability Type: Sensitive credential accepted and promoted through process arguments
Risk Level: Medium

Vulnerable Documentation:

bash

python {baseDir}/scripts/perform_web_search.py \
  --query "阿里巴巴2024年的ESG报告" \
  --summary true \
  --freshness noLimit \
  --count 10 \
  --api-key YOUR_API_KEY

Vulnerable Implementation:

python

parser.add_argument(
    "--api-key", "-k",
    help="Gitee AI API key for Authorization: Bearer <token>"
)

Technical Analysis

The program accepts the Gitee AI bearer token through --api-key, and the primary usage example encourages this method. Command-line arguments may be recorded in shell history, process-monitoring telemetry, job logs, terminal transcripts, or orchestration metadata. Depending on operating-system process visibility, they may also be observable by other local users while the process is running.

The implementation does not print the API key directly and provides the safer GITEEAI_API_KEY environment-variable fallback. Nevertheless, preserving the command-line option and promoting it in documentation creates an avoidable credential-disclosure path.

Attack Path

1. A user replaces YOUR_API_KEY with a valid bearer token and runs the documented command.
2. The complete command is retained in shell history, execution logs, telemetry, or process metadata.
3. Another local user, administrator, support operator, or compromised logging service reads the recorded argument.
4. The observer extracts the bearer token.
5. The token is submitted to the Gitee AI API before it expires or is revoked.

Impact Assessment

An attacker could perform API operations authorized by the exposed token, consume the account's quota, generate charges where applicable, and access any API functionality granted to that credential. Th ...[truncated 170 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key argument and obtain the credential from GITEEAI_API_KEY or a platform-managed secret store.
• Remove command-line credentials from the usage example and document environment-based invocation instead.
• Where environment variables are unsuitable, accept the secret through a non-echoing interactive prompt or protected standard input.
• Ensure CI/CD and orchestration platforms inject the key through their native secret-management facilities.
• Apply least privilege and expiration controls to API tokens.
• Rotate the token immediately if it has previously appeared in shell history, process logs, or telemetry.
• Configure logging systems to redact authorization credentials and restrict access to execution metadata.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: moark-web-search
description: Search web content such as webpages, images, and videos using the /web-search API with an Access Token.
metadata:
  {
    "openclaw":

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/perform_web_search.py (reported line 38)May include surrounding context.

python

def get_api_key(provided_key: Optional[str]) -> Optional[str]:
    """Get API key from argument or environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GITEEAI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires environment access and network access but does not declare an explicit tool scope such as permissions or allowed-tools. That creates an under-specified trust boundary: an agent may run code that reads secrets and makes outbound requests without the skill clearly constraining or documenting those capabilities.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/perform_web_search.py (reported line 109)May include surrounding context.

python

print(f"Count: {args.count}")

    try:
        response = requests.post(
            API_URL,
            headers=headers,
            json=payload,

Static analysis

No suspicious patterns detected.