Volcengine Web Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.0

Overview

This web-search skill is coherent in purpose, but it sends both user queries and an API key to a third-party proxy with broad activation language and limited consent/data-handling disclosure.

Install only if you are comfortable sending your search terms and AZT API key to coze-js-api.devtool.uk. Prefer a dedicated, low-privilege, revocable key; avoid secret, personal, regulated, or internal queries; use the AZT_API_KEY environment variable instead of command-line arguments; and treat this as a third-party proxy integration rather than a local or first-party Volcengine-only tool.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/web_search.py:50

Finding

API Credential and Search Queries Disclosed to a Third-Party Proxy

Content

View full analysis

dict: payload: dict = { "api_key": api_key, "query": query, "search_type": search_type, } if count is not None: payload["count"] = count if need_summary is not None: payload["need_summary"] = need_summary if time_range: payload["time_range"] = time_range if content_formats: payload["content_formats"] = content_formats if industry: payload["industry"] = industry if query_rewrite is not None: payload["query_control"] = {"QueryRewrite": query_rewrite} try: response = requests.post( API_URL, json=payload, timeout=60, headers={"Content-Type": "application/json"}, ) response.raise_for_status() return response.json() ``` ### Technical Analysis The script submits the API credential, search query, search type, and optional search parameters to `coze-js-api.devtool.uk`. This is a privately operated proxy rather than an official Volcengine endpoint. Network transmission is necessary for the declared web-search functionality, and the endpoint is disclosed in the Skill documentation. Therefore, the audit found no evidence that the transmission is covert or unrelated to the Skill's purpose. However, proxying the request expands the trust boundary: HTTPS protects data in transit but does ...[truncated 1589 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/web_search.py:34

Finding

API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

str: key = arg_key or os.environ.get("AZT_API_KEY", "").strip() if not key: print( "❌ 未检测到 API Key。\n" " 请前往 https://devtool.uk/plugin 购买或查看使用说明，\n" " 然后通过以下任一方式提供 Key：\n" " 1. 设置环境变量：export AZT_API_KEY=\"your_key\"\n" " 2. 传入参数：python3 web_search.py --azt_api_key your_key --query 关键词 --search_type web", file=sys.stderr, ) sys.exit(1) return key ``` ```python parser.add_argument("--azt_api_key", default=None, help="API Key（也可通过环境变量 AZT_API_KEY 设置）") ``` ### Technical Analysis The script accepts the API key using the `--azt_api_key` command-line option and explicitly recommends that method in its error output. Command-line arguments are not an appropriate secret-delivery channel on many systems because they may be: - Saved in shell history. - Visible to local process-inspection utilities. - Collected by process accounting, endpoint monitoring, diagnostics, or audit systems. - Included in copied command output, support bundles, terminal logs, or automation logs. The implementation also prioritizes the command-line value over `AZT_API_KEY`: ```python key = arg_key or os.environ.get("AZT_API_KEY", "").strip() ``` This conflicts with `SKILL.md`, which states that the environment variable is resolved first. The mismatch increases the chance that an unintentionally supplied command-line value overrides the safer source. ### Attack Path 1. A user follows the displayed example and invokes the script with `--azt_api_key `. 2. The shell may persist the complete invocation in its history file. 3. While the process runs, ...[truncated 784 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/web_search.py:10

Finding

Unpinned Dependency Installation Guidance Weakens Supply-Chain Integrity

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs execution of a Python script that uses environment variables and makes outbound network requests, but the manifest does not declare any tool scope or permission boundaries. This creates a capability-transparency gap: users and hosting systems are not clearly informed that the skill can access local secrets and transmit data to a remote endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs requests to a remote endpoint and requires an API key, but it does not clearly warn users that both search queries and credentials will be transmitted to a third-party service. This lack of disclosure undermines informed consent and can lead to accidental leakage of sensitive prompts or secrets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger conditions are broad enough to activate for generic web-search intents, which can cause the agent to route ordinary queries through this third-party skill by default. In context, that increases the chance of unnecessary external transmission of user prompts and credentials to an unscoped remote service.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The output format tells the model to disclose whether the API key came from an environment variable or direct user input. Even without revealing the key itself, exposing secret provenance and handling paths leaks operational security details that can aid prompt attacks, social engineering, or environment fingerprinting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script's natural-language interface and user-facing messages are entirely in Chinese, including the module docstring and CLI help/error text, with no indication that language can be selected. The policy requires flagging language or locale constraints when they are imposed without user opt-in or a documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This code performs an external HTTP POST containing the search query and API key to a non-local service. In the context of an agent skill whose purpose is web search, external transmission is expected, but it still matters because user prompts may include sensitive data and the endpoint is an intermediary domain rather than a clearly official vendor API, increasing trust and data-governance concerns.

Content

Scanner excerpt · scripts/web_search.py (reported line 79)May include surrounding context.

python

payload["query_control"] = {"QueryRewrite": query_rewrite}

    try:
        response = requests.post(
            API_URL,
            json=payload,
            timeout=60,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends the user's query and API key to a third-party endpoint over the network, but it does not provide a clear runtime warning or consent step before transmitting potentially sensitive data. In an agent-skill context, users may assume the tool is local or first-party, so silent external transmission increases privacy and credential-exposure risk if queries contain secrets or regulated data.

Content

No source excerpt is available for this finding.