小艺联网搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.1

Overview

The skill appears to perform its stated Huawei Cloud web-search function, but it asks users to hard-code a live cloud token and includes an unnecessary npm fs dependency.

Review before installing. Use a dedicated, least-privileged Huawei Cloud token and avoid pasting it into source code; prefer an environment variable or local secret file excluded from version control. Remove the npm fs dependency and pin reviewed dependency versions before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/web-access.js:18

Finding

Plaintext API Token Storage in Source Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-65 and scripts/web-access.js:18-21
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

The installation instructions explicitly direct users to insert a Huawei Cloud bearer token into the JavaScript source file:

javascript

// 👇 把你的 TOKEN 填入下面引号中
const TOKEN = '';

The corresponding application code defines and subsequently uses that source-level token:

javascript

// API 配置
// 🔑 必填：请填入你的华为云 AI 联网增强 Token
// 开通指南：https://developer.huawei.com/consumer/cn/doc/AppGallery-connect-Guides/agc-ainetworking-serviceopen-0000002370503878
const API_URL = 'https://connect-api.cloud.huawei.com/api/aiNetworking/v1/webSearch';
const TOKEN = '';

Technical Analysis

Although the distributed copy contains an empty value, the documented configuration process requires users to replace it with a live secret. This stores the bearer token as plaintext project content rather than retrieving it from a protected runtime credential source.

Once populated, the secret may be exposed through source-control commits, package publication, project archives, automated backups, shared development directories, code-review systems, or diagnostic bundles. The application then places the value into the HTTP Authorization header:

javascript

headers: {
  'Content-Type': 'application/json',
  'Authorization': `Bearer ${TOKEN}`
},

A bearer token generally grants its holder the associated API authorization without requiring additional proof of identity. Therefore, disclosure is sufficient for reuse until the token expires or is revoked.

Attack Path

1. A user follows SKILL.md and inserts a valid Huawei Cloud token into scripts/web-access.js.
2. The populated source file is committed, packaged, backed up, shared, or otherwise exposed to an unauthorized party.
3. The unauthorized party extracts the plaintext token ...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove source-level token configuration and read the credential from a protected environment variable:

   javascript

   const TOKEN = process.env.HUAWEI_AI_NETWORKING_TOKEN;
   
   if (!TOKEN) {
     throw new Error('HUAWEI_AI_NETWORKING_TOKEN is required');
   }
   

2. Update SKILL.md to instruct users to configure the environment variable or an approved secret manager rather than editing JavaScript source.

3. Ensure local environment files containing secrets are excluded from source control, package publication, backups, and diagnostic output.

4. Never print the token or complete authorization header in logs and error messages.

5. Apply least privilege, expiration, usage limits, and rotation controls to the token where supported.

6. Revoke and replace any live token that has previously been committed, packaged, shared, or published. Removing it from the latest revision alone is insufficient because it may remain in repository history or external archives.

7. Add automated secret scanning to source-control and release workflows to prevent future credential disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to paste a live Huawei Cloud API token directly into a JavaScript source file, which creates a high chance the credential will be exposed through local file disclosure, backups, screenshots, shell history, or accidental commits to version control. Because this token grants access to a cloud-backed network search service, exposure could enable unauthorized API use, quota abuse, billing impact, and loss of control over the associated account or project resources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description '华为云AI联网搜索API进行网页内容检索' is broad and does not clearly limit when the skill should be invoked, what kinds of queries it is appropriate for, or what safety boundaries apply. In an auto-loaded skill, this ambiguity can cause over-invocation, unnecessary external data access, and increased exposure to prompt-injection or untrusted web content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The description is presented only in Chinese and implies a fixed language context without stating whether this is locale-specific or user-selectable. This can lead to incorrect routing or invocation for users in other locales, causing confusion and potentially unsafe handling if users do not understand that external web retrieval is being performed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file presents its purpose, usage, and user-facing instructions entirely in Chinese, and the runtime help output also uses Chinese only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret range (^1.6.0) instead of an exact pinned version, which makes builds non-reproducible and can silently pull in different upstream releases over time. In a security-sensitive skill that performs web access, this increases supply-chain risk because vulnerable or behavior-changing versions may be installed without review.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json

"huawei"
  ],
  "dependencies": {
    "axios": "^1.6.0",
    "fs": "^0.0.1-security"
  }
}

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest references axios with a non-exact version, while the package has multiple known advisories, including SSRF-related issues. Because this skill's purpose is live web retrieval, any vulnerable HTTP client behavior is more relevant than usual and could affect request routing, proxy handling, or response trust boundaries.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: fs has 1 known advisory(ies) (MAL-2025-21003 (Malicious code in fs (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Declaring fs as an npm dependency is highly suspicious because Node.js already provides fs as a built-in module, and the npm fs package is associated here with a malicious-package advisory. If installed, this creates unnecessary supply-chain exposure and could introduce arbitrary malicious code during install or runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline comment says the code is limiting results to a maximum of 20, but the implementation uses Math.min(count, 10), which actually caps results at 10. This is an intent/documentation mismatch in the code comments rather than a security-relevant behavior change.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.