查找资料

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:33 AM UTC
• Version: 1.0.1

Overview

This search skill does what it claims, but it sends user queries to a third-party HTTP API using a hardcoded bearer token, which creates avoidable privacy and credential exposure risk.

Review before installing. Avoid sending secrets, personal information, confidential business terms, or sensitive URLs through this skill unless the provider replaces plaintext HTTP with HTTPS, removes the shared hardcoded token, and documents how queries and crawled content are handled.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Hardcoded Bearer Credential Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–25, 76–78, and 226
Vulnerability Type: Hardcoded credential and insecure transport
Risk Level: High

Vulnerable Code

Lines 23–25:

markdown

**端点**: `POST http://36.151.144.35:3001/api/v1/search`

**认证**: `Bearer sk_test_a6f84bf78896f10b2d28aebd7857744c`

Lines 76–78:

markdown

**端点**: `POST http://36.151.144.35:3001/api/v1/news`

**认证**: `Bearer sk_test_a6f84bf78896f10b2d28aebd7857744c`

Line 226:

markdown

5. 所有请求必须在 Header 中包含 `Authorization: Bearer sk_test_a6f84bf78896f10b2d28aebd7857744c`

Technical Analysis

The Skill embeds a static bearer credential directly in a project file and explicitly instructs the Agent to send it to a remote service. Anyone with access to the package, repository, logs, generated prompts, or documentation can retrieve and attempt to reuse the credential.

Both documented API endpoints use unencrypted http:// URLs at a bare IP address. HTTP provides neither transport encryption nor authenticated server identity. Consequently, the bearer token, user search queries, and API responses are exposed to passive network monitoring and active man-in-the-middle modification.

Because bearer authentication grants access based solely on possession of the token, an attacker who obtains it does not need any additional proof of identity. The audit did not validate whether the exposed token remains active, but the Skill presents it as mandatory authentication, so it must be treated as compromised and rotated.

Attack Path

1. A user invokes the Skill to perform a search or news query.
2. The Agent follows SKILL.md and sends an HTTP POST request to 36.151.144.35:3001.
3. The request includes the static token in the Authorization header and may include sensitive user search terms in the JSON body.
4. An attacker with visibility or control over the network path captures the unencrypted ...[truncated 1334 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed bearer credential. Treat it as compromised even if it is labeled as a test token.
2. Remove all credentials from SKILL.md and from any repository history, generated packages, examples, logs, and cached artifacts.
3. Supply credentials at runtime through an approved secret manager or protected environment variable. Do not print the value or expose it to model-visible context unless strictly required.
4. Replace both http:// endpoints with https:// endpoints using a valid certificate and mandatory certificate verification.
5. Prefer a stable domain name with authenticated TLS identity instead of a bare IP address. Do not allow fallback to plaintext HTTP.
6. Issue separate, short-lived credentials per installation or user rather than distributing a shared static token.
7. Restrict the credential to only the required search operations, enforce rate and spending limits, and monitor for replay or abnormal usage.
8. Inform users that their queries are transmitted to an external service and avoid sending secrets, personal information, or other sensitive content without explicit authorization.
9. Validate the response schema and treat all returned titles, URLs, snippets, and crawled content as untrusted external input.
10. Add automated secret scanning and policy checks that reject hardcoded API keys and non-TLS service endpoints before release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to send user search queries and optionally crawl third-party page content through an external service, but it does not disclose the privacy, data-handling, or consent implications. This is especially risky because the documentation also includes a hardcoded bearer token and uses a direct remote endpoint, creating a realistic path for sensitive user queries or fetched content to be transmitted to an untrusted third party without user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language instructions and examples are entirely presented in Chinese, and the skill does not state that this is optional or region-specific. The policy asks to flag language or locale constraints when a specific language is effectively imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:226