Security audit

legal-cn-api

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real paid Chinese legal search API, but it ships credentials and high-impact database/payment behaviors that need human review before installation.

Install only after the publisher removes and rotates the committed Moltbook credentials, replaces raw/private-key config guidance with secure secret handling, fixes payment enforcement to fail closed for paid deployments, removes predictable master-key defaults, pins dependencies and container images, and adds safeguards around database updates and index deletion.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: moltbook-credentials.json:1
Finding: Plaintext Service Credentials and Account-Claim Token Committed to the Project
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: main.py:68
Finding: Paid Search Endpoint Fails Open When Payment Verification Is Disabled or Initialization Fails
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: main.py:135
Finding: Hardcoded Shared Rate-Limit Identity Enables Global Denial of Service
Content: View full analysis
bool: now = datetime.now() minute_ago = now - timedelta(minutes=1) request_counts[client_ip] = [t for t in request_counts[client_ip] if t > minute_ago] request_counts[client_ip].append(now) return len(request_counts[client_ip]) <= config.MAX_REQUESTS_PER_MINUTE ``` ```python # Rate-limit check client_ip = "127.0.0.1" # TODO: get client ip from request if not check_rate_limit(client_ip): raise HTTPException(status_code=429, detail="Rate limit exceeded, try again later") ``` ### Technical Analysis Every request is assigned the same hardcoded identity, `127.0.0.1`. Consequently, all users share one global request bucket. A single caller can consume the complete allowance and cause all other callers to receive HTTP 429 responses. The limiter is also held in process-local memory. Multiple worker processes would maintain inconsistent counters, while process restarts would reset all limits. The implementation therefore provides neither reliable per-client protection nor reliable distributed enforcement. ### Attack Path 1. An attacker repeatedly calls `/api/v1/search`. 2. Every request increments the shared `127.0.0.1` bucket. 3. The bucket exceeds `MAX_REQUESTS_PER_MINUTE`. 4. Requests from unrelated legitimate users are mapped to the same bucket. 5. Those users receive HTTP 429 until entries expire or the process restarts. ### Impact Assessment An unauthenticated remote caller can cause temporary service denial for all search users. No operating-system privileges are obtained, but the availability of the paid API can be disrupted repeatedly at low cost. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: docker-compose.yml:5
Finding: Predictable Hardcoded Meilisearch Administrative Key
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Python Dependencies and Mutable Container Image Create Supply-Chain Risk
Content: View full analysis
=0.3.0 fastapi>=0.100.0 uvicorn>=0.29.0 python-multipart>=0.0.6 pydantic>=2.0.0 httpx>=0.27.0 pillow>=10.0.0 x402>=0.2.0 web3>=6.0.0 ``` ```yaml image: getmeili/meilisearch:latest ``` The installation metadata directly executes the unpinned dependency installation: ```json "install": [ "pip install -r requirements.txt", "cp config.py.example config.py" ] ``` ### Technical Analysis Every Python requirement uses an open-ended lower-bound constraint, permitting installation of future package versions that were not part of this audit. The Meilisearch container uses the mutable `latest` tag, which can resolve to different image contents over time. Python package installation can execute build backend or setup code. Container startup executes the downloaded image. A compromised upstream release, malicious transitive dependency, or incompatible future version could therefore alter behavior after review. This finding identifies unsafe dependency controls; the reviewed files do not establish that any currently named package is malicious. ### Attack Path 1. An operator follows the documented installation or deployment procedure. 2. The package manager resolves the newest versions allowed by the open-ended constraints, or Docker resolves the current `latest` image. 3. An upstream compromise or unexpected release causes different code to be downloaded. 4. Installation hooks or container startup execute the changed code with the deployment user's privileges. 5. The changed dependency can access application configuration, wallet material, database credentials, and network resources available to the service. ### Impact Assessment The potential impact is execution with the privileges of the installer or container runtime and access to s ...[truncated 232 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: update_database.sh:8
Finding: Unverified Remote Dataset Update Deletes and Replaces the Production Search Index
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (43)

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file includes setup steps that require users to place wallet-related secrets into config.py, which can affect security if mishandled. The README does not include any warning about protecting keys, avoiding committing the file, or using secure secret storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions explicitly tell users to place a wallet private key into a local config.py file, but provide no warnings about secret handling, exclusion from version control, encryption, rotation, or use of a dedicated low-privilege wallet. In a skill/deployment context, this can lead operators or downstream agents to store highly sensitive signing credentials insecurely, causing theft of funds or unauthorized payment activity if the file is exposed through source control, logs, backups, or host compromise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s natural-language title and API descriptions explicitly present the skill as a China-specific legal search service in Chinese, with no indication that users can choose another language or locale. This creates a language/locale policy issue because the skill appears to impose a specific locale experience rather than offering user choice or clearly documenting an opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The search endpoint is intended as a paid API, but the application explicitly falls back to open-access mode whenever x402 is disabled or misconfigured. That means a deployment error, missing private key, or initialization failure silently removes payment enforcement while still serving the protected endpoint, enabling unauthorized free use and revenue bypass.
Content: No source excerpt is available for this finding.

Internal Network Request

Medium

Category: Server-Side Request Forgery
Confidence: 70% confidence
Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content: Scanner excerpt · test_api.py (reported line 21)May include surrounding context.
python
print("\n" + "="*50) print("\nTesting health check...") response = requests.get("http://localhost:8000/health") print(f"Response: {response.json()}")

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file contains user-facing strings such as "搜索关键词" and "法律数据库完整搜索测试" that force a specific language/locale. The policy for SQP-3 applies to all file types and flags language constraints unless the skill offers user opt-in or clearly documents a justified locale-specific scope, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script hardcodes a Meilisearch master key directly in source code, which is an administrative credential with full access to the search service. If this file is committed, shared, or deployed broadly, an attacker who obtains the code can use the key to read, modify, or delete indexes and potentially pivot into related systems.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file-level docstring says "Get 2025 laws," which implies a narrower scope limited to 2025. However, the filtering logic includes any law with a year of 2024 or later, and the printed heading explicitly states the range "2024-2026," contradicting the documented intent rather than merely omitting detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing output string forces Chinese-language output regardless of user preference. Under the policy, language or locale restrictions should either be user-selectable or clearly documented as a justified region-specific constraint, which is not present in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script embeds Meilisearch's privileged "masterKey" directly in source code, which is a hardcoded secret and grants full administrative access to the search service if exposed. In an agent skill or shared codebase, this is especially dangerous because the key can be leaked through repository access, logs, packaging, or reuse in other environments, enabling index manipulation, data extraction, or service reconfiguration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script prints its user-facing output entirely in Chinese using a fixed message literal. For a general-purpose utility, this imposes a specific language without any opt-in, selection mechanism, or justification that the tool is intended only for a Chinese-language audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script unconditionally deletes the target Meilisearch index before recreating it, using a default index name and no confirmation or dry-run safeguard. In an operational environment, a mistaken invocation, wrong host, or reused credentials can cause immediate data loss or service disruption, especially because deletion happens before any validation of the input dataset or successful reimport.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script unconditionally deletes the target Meilisearch index before recreating it, with no confirmation, dry-run mode, or safety flag. If run against the wrong host or with an important index name, this causes immediate data loss and service disruption, especially because the default master key and localhost assumptions may encourage casual execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script unconditionally attempts to delete the target Meilisearch index before recreating it, with no confirmation, backup, dry-run mode, or explicit force flag. In a data import utility, this can cause accidental destruction of an existing production index and loss of availability or data if the operator points the script at the wrong host or index.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The entire skill description is presented only in Chinese and frames the API for Chinese legal retrieval without any note that the language is a deliberate locale constraint or any option for user language preference. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency is specified with a lower-bound range instead of an exact pinned version, which makes builds non-reproducible and allows future installs to pull different releases over time. This increases supply-chain risk and makes it harder to verify whether deployed environments include vulnerable versions.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
meilisearch>=0.3.0 fastapi>=0.100.0 uvicorn>=0.29.0 python-multipart>=0.0.6

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The FastAPI dependency is unpinned, so installations may resolve to different versions depending on when and where the environment is built. That weakens reproducibility and can silently introduce vulnerable or incompatible releases into production.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
meilisearch>=0.3.0 fastapi>=0.100.0 uvicorn>=0.29.0 python-multipart>=0.0.6 pydantic>=2.0.0

Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: FastAPI has known advisories, but the manifest does not pin a specific version, so it is impossible to verify whether installed environments are affected. The primary risk here is unverifiable exposure: different installs may pull versions with known flaws, especially in a web-facing framework.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Using an unpinned uvicorn version allows package resolution to drift over time, which can unexpectedly introduce vulnerable or behavior-changing releases. In an API-serving context, that can affect the externally exposed application stack.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
meilisearch>=0.3.0 fastapi>=0.100.0 uvicorn>=0.29.0 python-multipart>=0.0.6 pydantic>=2.0.0 httpx>=0.27.0

Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: Uvicorn has known advisories, and without version pinning there is no reliable way to determine whether a deployed build includes a vulnerable release. Since uvicorn is part of the server-facing stack, uncertainty around its exact version increases operational security risk.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The python-multipart package is unpinned, so future installs may pick up different parser versions without review. Because multipart parsers process attacker-controlled request bodies, uncontrolled version drift can increase exposure to parsing-related vulnerabilities.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
meilisearch>=0.3.0 fastapi>=0.100.0 uvicorn>=0.29.0 python-multipart>=0.0.6 pydantic>=2.0.0 httpx>=0.27.0 pillow>=10.0.0

Unverifiable Dependency: python-multipart has 16 known advisory(ies) (CVE-2024-24762 (python-multipart vulnerable to Content-Type Header ReDoS); CVE-2024-53981 (Denial of service (DoS) via deformation `multipart/form-data` boundary); CVE-2026-53539 (python-multipart: Quadratic-time querystring parsing with semicolon separators c) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: python-multipart has multiple advisories, including denial-of-service issues, and the dependency is not pinned to a verifiable safe release. In an application that likely handles file uploads or form data, this uncertainty is more dangerous because attacker-controlled multipart payloads are common input paths.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The pydantic dependency is not fixed to a specific version, reducing reproducibility and making it difficult to guarantee that validation behavior and security fixes are consistently present. This can lead to inconsistent runtime behavior across environments.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
fastapi>=0.100.0 uvicorn>=0.29.0 python-multipart>=0.0.6 pydantic>=2.0.0 httpx>=0.27.0 pillow>=10.0.0 x402>=0.2.0

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: Pydantic has known advisories, and because the requirement is unpinned, the deployed version cannot be verified as patched. This creates uncertainty in a core validation library that processes user-controlled input across the application.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.