Security audit
Security checks for vulnerabilities and agentic risk
This research skill needs review because its authentication and browsing features can expose local files and API keys.
Prefer local stdio operation in an isolated environment with only necessary keys. Before using HTTP hosting or credential-assisted browsing, require fixes for built-in administrator access, unrestricted file access, and credential origin matching. Load only trusted NumPy datasets, verify provider destinations, and disable tracing for private inputs. Scanner coverage was partial: executable gaps and targeted document/test gaps were independently checked; live browser and external-service integrations were not exercised.
scripts/infoseek_auth.pyBuilt-in OAuth administrator credentials bypass configured HTTP bearer authentication
Unauthorized tool invocation includes reading server-readable text files through fetch_content_async with a file:// URL. This can disclose application configuration and credentials. Other exposed tools can write archives or modify the stored key registry.
scripts/mcp_tools_search.pyCredential-assisted browsing leaks bearer credentials across origin boundaries
A page rendered with a legitimate bearer credential can cause that credential to accompany cross-origin resource requests. The hostname-prefix fallback additionally allows an attacker-controlled openai-prefixed hostname to select OPENAI_API_KEY when available, sending that unrelated API key directly to the attacker-controlled site. Disclosure occurs in outbound request headers even if rendering or content extraction later fails.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"Authorization": f"Bearer {api_key}",
},
)
with urllib.request.urlopen(req, timeout=60) as resp:
data = json_mod.loads(resp.read().decode('utf-8'))
content = data['choices'][0]['message']['content']
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"anthropic-version": "2023-06-01",
},
)
with urllib.request.urlopen(req, timeout=60) as resp:
data = json_mod.loads(resp.read().decode('utf-8'))
content = data['content'][0]['text']
usage = data.get('usage', {})
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"""标准库 GET（无第三方依赖）。v1.0.1 PATCH: 默认超时 10s→3s 加速降级链。"""
import urllib.request
req = urllib.request.Request(url, headers={'User-Agent': _UA})
with urllib.request.urlopen(req, timeout=timeout) as resp:
return resp.read()
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"https://api.exa.ai/search", data=payload,
headers={'Content-Type': 'application/json',
'x-api-key': key}, method='POST')
with urllib.request.urlopen(req, timeout=15) as resp:
data = json.loads(resp.read().decode('utf-8', errors='ignore'))
out = []
for r in (data.get('results') or []):
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
req = urllib.request.Request(
"https://api.tavily.com/search", data=payload,
headers={'Content-Type': 'application/json'}, method='POST')
with urllib.request.urlopen(req, timeout=15) as resp:
data = json.loads(resp.read().decode('utf-8', errors='ignore'))
out = []
for r in (data.get('results') or []):
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"https://open.bigmodel.cn/api/paas/v4/web_search", data=payload,
headers={'Content-Type': 'application/json',
'Authorization': f'Bearer {key}'}, method='POST')
with urllib.request.urlopen(req, timeout=15) as resp:
data = json.loads(resp.read().decode('utf-8', errors='ignore'))
out = []
for r in (data.get('search_result') or []):
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"https://api.metaso.cn/v1/search", data=payload,
headers={'Content-Type': 'application/json',
'Authorization': f'Bearer {key}'}, method='POST')
with urllib.request.urlopen(req, timeout=15) as resp:
data = json.loads(resp.read().decode('utf-8', errors='ignore'))
out = []
for r in (data.get('results') or []):
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method='POST',
)
try:
with urllib.request.urlopen(req, timeout=timeout) as resp:
raw = resp.read().decode('utf-8', errors='ignore') or '{}'
return json.loads(raw)
except urllib.error.HTTPError as e:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}
)
with urllib.request.urlopen(req, timeout=30) as resp:
result = json.loads(resp.read().decode('utf-8'))
# 解析响应
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
req = urllib.request.Request(
f'{self._url}/jsonrpc', data=body,
headers={'Content-Type': 'application/json'})
with urllib.request.urlopen(req, timeout=_CALL_TIMEOUT) as resp:
msg = json.loads(resp.read().decode())
if 'error' in msg:
raise RuntimeError(f'HTTP {method} 错误: {msg["error"]}')
The supplied module specifically serves a fake-detection pipeline using follower counts, engagement rates, follower quality, template similarity, activity profiles, time series, and account relationship graphs. These are not implementations of the declared source discovery, content fetching, semantic analysis, or report-generation workflow. Although data ingestion and cleaning can support research generally, this module's explicit interface and demonstration target a distinct account-authenticity analysis capability. This assessment is limited to the supplied code chunk and does not establish what the rest of the skill implements.
The supplied module implements a specialized account-coordination detector, rather than the declared content acquisition and research workflow. Its spike synchronization and suspicious-group classification are materially different from semantic contradiction detection, entity recognition, or cross-source research synthesis. Although such analysis could potentially inform source credibility, neither the description nor this code establishes that supporting role. The chunk performs in-memory analysis only; no external resource access, unrelated triggers, or permission violations are evident.
The supplied module's primary purpose is account authenticity classification, rather than content acquisition or research orchestration. compute_l1_features derives account-behavior and graph features, and apply_l1_rules combines suspicious indicators into n_flags and a binary pred output. Although authenticity signals could support source credibility assessment, this code implements a distinct account-detection capability not disclosed in the description, rather than the stated four-dimensional source-scoring workflow. The chunk shows no network access, credential use, external writes, or report generation; the mismatch concerns its substantive analytical purpose, not unauthorized resource access.
Consent-registry checks and trusted-source inspection are plausible supporting features of the declared workflow and are not independently mismatches. However, this chunk primarily implements security and compliance auditing, including filesystem credential discovery and key-manager inspection that the description does not disclose. It does not implement the described research pipeline. Its visible network-boundary checks are static; no direct network requests or credential exfiltration are shown. Despite the script's read-only documentation, optional report output explicitly creates directories and writes files. This assessment is limited to the supplied chunk, not the rest of the skill.
Credibility scoring could reasonably support the declared research workflow, so the absence of collection or report-generation code in this individual module is not itself a mismatch. However, this module implements a substantial account-forensics capability: it profiles individual accounts, labels them as likely real or bots, and identifies coordinated groups. Those capabilities go materially beyond the description's source-credibility scoring and are not explicitly disclosed. The supplied code does not show unrelated network access, exfiltration, or malicious side effects; the mismatch concerns an undeclared analytical capability.
Tracing itself is a supporting implementation detail, and this chunk need not implement the entire declared research workflow. However, exporting tool arguments and exception details introduces an undeclared data-disclosure capability beyond internal instrumentation. Arguments are serialized and truncated to 2,000 characters, not sanitized. Network export requires explicit exporter configuration and available dependencies; the code does not demonstrate unconditional remote transmission or a hardcoded external recipient.
The chunk primarily provides a QCM integration rather than the declared information-collection pipeline. Research delegation could support the stated purpose, and subprocess execution and OAuth are ordinary implementation details. However, the additional QCM validation and case-gap-analysis capabilities, and the external service receiving their inputs, are not represented in the description. The mismatch concerns those concrete capabilities, not the absence of the rest of the workflow from this single file. There is no evidence here of a hard-coded exfiltration destination or malicious behavior.
Referenced artifact was not completely inspected
> 标志位有效）。守护见 `tests/test_three_chain_v183.py`（63 check）。
Referenced artifact was not completely inspected
详见 `references/ROADMAP.md`（当前基线 · 待办 · 前景方向）；v1.0.0→v2.0.0 历次实施细节见 `references/ROADMAP_archive_20260917.md`。
Referenced artifact was not completely inspected
| `references/ROADMAP.md` | 当前基线 · 待办 · 前景方向（纯净版） |
Referenced artifact was not completely inspected
详见 `references/ROADMAP.md`（当前基线 · 待办 · 前景方向）；v1.0.0→v2.0.0 历次实施细节见 `references/ROADMAP_archive_20260917.md`。
Referenced artifact was not completely inspected
| `references/ROADMAP_archive_20260917.md` | v1.0.0→v2.0.0 历史实施记录归档 |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
'install_hint': 'pip install opentelemetry-api opentelemetry-sdk'},
{'name': 'cryptography', 'kind': 'python_pkg', 'import': 'cryptography',
'required': False, 'install_hint': 'pip install cryptography'},
{'name': 'keyring', 'kind': 'python_pkg', 'import': 'keyring',
'required': False, 'install_hint': 'pip install keyring'},
{'name': 'schedule', 'kind': 'python_pkg', 'import': 'schedule',
'required': False, 'install_hint': 'pip install schedule'},
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
'install_hint': 'pip install opentelemetry-api opentelemetry-sdk'},
{'name': 'cryptography', 'kind': 'python_pkg', 'import': 'cryptography',
'required': False, 'install_hint': 'pip install cryptography'},
{'name': 'keyring', 'kind': 'python_pkg', 'import': 'keyring',
'required': False, 'install_hint': 'pip install keyring'},
{'name': 'schedule', 'kind': 'python_pkg', 'import': 'schedule',
'required': False, 'install_hint': 'pip install schedule'},
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
{'name': 'cryptography', 'kind': 'python_pkg', 'import': 'cryptography',
'required': False, 'install_hint': 'pip install cryptography'},
{'name': 'keyring', 'kind': 'python_pkg', 'import': 'keyring',
'required': False, 'install_hint': 'pip install keyring'},
{'name': 'schedule', 'kind': 'python_pkg', 'import': 'schedule',
'required': False, 'install_hint': 'pip install schedule'},
{'name': 'openai-whisper', 'kind': 'python_pkg', 'pip': 'openai-whisper',