Security audit
Security checks for vulnerabilities and agentic risk
This search skill mostly matches its stated purpose, but it handles Pangolin credentials in a risky persistent plaintext cache.
Install only if you are comfortable giving this skill access to a Pangolin API key or Pangolin account credentials, having search terms sent to Pangolin, and having a reusable API key stored in plaintext at ~/.pangolin_api_key. Prefer creating a restricted API key, avoid sending raw passwords through the agent chat, remove the cache file when done, and rotate the key if it may have appeared in logs.
scripts/pangolin.py:94Permanent API Key Is Written Before Secure Permissions Are Applied
scripts/pangolin.py:485Authentication Check Discloses Part of a Permanent API Key
SKILL.md:94Credential Setup Instructions Embed the Full API Key in a Shell Command
The code sends email and password from environment variables to a remote authentication endpoint over the network. This is expected functionality for login, so it is not inherently malicious, but it is still a real credential-exposure surface because the script transmits secrets to a third-party service and offers no trust prompt, endpoint pinning, or explicit disclosure beyond code/comments.
method="POST",
)
try:
with urllib.request.urlopen(req, timeout=30) as resp:
result = json.loads(resp.read())
except urllib.error.URLError as e:
# Improvement 1: macOS SSL certificate handling
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers=headers,
method="POST",
)
with urllib.request.urlopen(req, timeout=timeout) as resp:
return json.loads(resp.read())
except urllib.error.HTTPError as e:
error_body = e.read().decode() if e.fp else ""
The instructions explicitly direct the agent to collect credentials from the user and persist them for future use by caching an API key in the user's home directory. Persisting secrets in this way expands the blast radius of compromise, can outlive user intent, and may expose credentials to other local processes, backups, or later unintended agent actions.
Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.
if sys.platform == "win32":
try:
import subprocess
subprocess.run(
["icacls", str(API_KEY_CACHE_PATH), "/inheritance:r",
"/grant:r", f"{os.environ.get('USERNAME', '')}:F"],
capture_output=True, check=False,
The skill clearly instructs the agent to use sensitive capabilities including environment access, file reads/writes, network calls, and shell execution, but it does not declare any explicit tool scope or permission boundaries. That increases the risk of overbroad execution and makes credential handling and filesystem persistence occur without clear platform-level guardrails or user visibility.
The skill is designed around session persistence by obtaining credentials once and reusing a cached API key across future invocations. In context, this persistence is more dangerous because it is tied to secret material stored locally and is framed as automatic, reducing user awareness and increasing long-term exposure if the host or account is compromised.
### Step 2: Guide registration
> 1. Go to [pangolinfo.com](https://www.pangolinfo.com) and create an account
> 2. After login, find your API Key in the dashboard
>
> 1. 访问 [pangolinfo.com](https://www.pangolinfo.com) 注册账号
The skill tells the agent to collect API keys or email/password from the user and then configure them locally, including writing the API key to ~/.pangolin_api_key for future use. Even though it mentions avoiding shell history, it does not require an explicit consent prompt that informs the user their credentials will be stored on disk and reused later, which creates a meaningful secret-handling risk.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Write it directly to the cache file — avoids shell history entirely:
echo "<api_key>" > ~/.pangolin_api_key
chmod 600 ~/.pangolin_api_key 2>/dev/null
python3 scripts/pangolin.py --auth-only
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Important
- **The user only needs to provide credentials ONCE** — the script caches the API key permanently at `~/.pangolin_api_key`
- Do not ask the user to manually edit `.bashrc` or `.zshrc` — the script handles persistence automatically
- If the user doesn't have an account yet, explain Pangolin's credit system (2 credits per AI Mode search, 0.5 credits per SERP search) and direct them to [pangolinfo.com](https://www.pangolinfo.com)
- If auth succeeds but credits are exhausted (error code `2001`), tell the user to top up at pangolinfo.com
- API key is permanent and does not expire unless the account is deactivated
This markdown file describes that the script automatically re-authenticates with email/password and later instructs users to set PANGOLIN_EMAIL and PANGOLIN_PASSWORD. Because credentials and cached tokens are sensitive, the documentation should explicitly warn users about secure handling and storage implications.
Documenting token caching at ~/.pangolin_token without any warning about file permissions or local secret exposure normalizes insecure secret storage. In an agent skill context, long-lived tokens cached on disk can be read by other local users, copied from developer environments, or unintentionally included in backups, increasing risk of account compromise.
This section shows credentials being sent to a remote authentication endpoint, which is a privacy- and security-relevant behavior. The documentation should explicitly disclose that user credentials are transmitted for login and advise secure handling.
Telling users to export PANGOLIN_EMAIL and PANGOLIN_PASSWORD without any warning can lead to sensitive credentials being retained in shell history, inherited by subprocesses, exposed in debugging output, or mishandled in shared environments. In a skill intended for automated agent use, this is more dangerous because agents often run in multi-tool, logged, or containerized environments where environment variables are broadly accessible.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if sys.platform == "win32":
try:
import subprocess
subprocess.run(
["icacls", str(API_KEY_CACHE_PATH), "/inheritance:r",
"/grant:r", f"{os.environ.get('USERNAME', '')}:F"],
capture_output=True, check=False,
The script collects account credentials from environment variables and posts them to the remote auth endpoint without a user-facing warning in the CLI flow. Although this supports expected authentication, the lack of explicit disclosure is risky in an agent-skill context because users may not realize passwords are being transmitted rather than only local API-key use.
When an API key is provided via environment variable, the script silently writes it to a local cache file for future reuse. Persisting sensitive tokens without explicit user notice or consent is dangerous because users may assume environment-scoped secrets remain ephemeral, while the tool leaves a recoverable artifact on disk.
The reference documents how to submit arbitrary Google search URLs to Pangolin's external scraping API but does not warn that user-provided queries will be transmitted to a third-party service. This can lead developers to unintentionally send sensitive prompts, identifiers, or internal research terms off-platform, creating privacy and data-handling risk even though it is not direct code execution or credential compromise.
The documentation states that tokens are permanent and do not expire on their own, but then says error code 1004 means the token needs to be refreshed. Those statements are in tension because an 'invalid or expired token' condition implies expiration or invalidation beyond simple account deactivation.
The skill persists the API key to ~/.pangolin_api_key, which expands the lifetime and local exposure of authentication material beyond the immediate session. Even with best-effort permission tightening, undisclosed secret persistence increases risk from local compromise, shared accounts, backups, or other software reading the file.
The manifest presents a search and screenshot skill, but on Windows the implementation imports subprocess and executes icacls to change file permissions on the cached API key file. Spawning an OS command is a broader host-interaction capability than the stated search behavior and is not mentioned in the manifest.
No suspicious patterns detected.