Security audit

Web Insight

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Feedax web-monitoring search tool, but it handles API keys and search queries unsafely over unencrypted HTTP and includes risky secret-check instructions.

Review carefully before installing. Use a low-privilege or disposable Feedax API key, avoid sensitive searches unless approved, do not run commands that print `.env` contents, expect queries to be sent to Feedax, and expect results to be saved on the Desktop unless you choose another output path. The HTTP endpoint should be treated as a serious security issue until replaced with HTTPS.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/search_cli.py:26
Finding: API credential and search data transmitted over plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skill.md:21
Finding: Documented API-key check exposes the complete secret
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:28
Finding: API key is placed in a project-local environment file without the claimed ignore protection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependencies are not pinned or integrity-verified
Content: View full analysis
=2.28.0 python-dotenv>=1.0.0 ``` ### Technical Analysis The lower-bound-only constraints permit installation of any future release of these packages. The project provides no lockfile or cryptographic hashes, so installations are not reproducible and package integrity is not explicitly verified against reviewed artifacts. The package names appear legitimate, and the audit found no evidence of dependency confusion, typosquatting, or an actively malicious dependency. The risk is the uncontrolled acceptance of future, potentially compromised or incompatible releases. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver selects the newest release satisfying each lower bound. 3. A future compromised, malicious, or incompatible release is resolved. 4. Package installation or import executes behavior not reviewed with this Skill. 5. The behavior runs with the privileges of the user or Agent environment performing installation. ### Impact Assessment The potential impact is bounded by the privileges of the installation and runtime account. A compromised dependency could access files, environment variables such as the API key, network resources, and data available to the Python process. No current malicious package was confirmed. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .env (reported line 2)May include surrounding context.
text
# Feedax Search API Key # 复制本文件为 .env 并填入你在 https://www.feedax.cn 申请的 Key（勿与他人共用） # 也可参考 .env.example FEEDAX_SEARCH_API_KEY=

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises an internet content monitoring and intelligence analysis skill with multi-source public web retrieval, query filters, NLP processing, and API-key-based external service access. The supplied code does none of that. It is a standalone command-line tool for parsing Chinese geographic names into administrative area codes using a local assets/area_codes.json file. Its functions are limited to loading local region data, exact/combined/fuzzy matching of place names, and returning province/city/county codes. This is a materially different primary purpose, with unrelated functionality and no evidence of network retrieval, public content monitoring, sentiment analysis, deduplication, structuring of online content, or use of the declared FEEDAX API credential.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向全网内容监测与情报分析的搜索技能，核心能力应包括外部数据访问、检索过滤和内容分析；而给出的代码仅是辅助性的时间范围计算脚本。该脚本的功能与“计算 publishTimeFrom/publishTimeTo 毫秒时间戳”完全一致，但这只是搜索系统中的一个小型工具组件，无法代表声明中的主要技能能力。虽然时间处理可能是搜索参数构造的支持细节，但当前提供的代码块本身与所宣称的主要用途相比差异重大，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The core purpose broadly matches: this code does internet/public-content retrieval with multiple filters and uses FEEDAX_SEARCH_API_KEY as declared. However, the description overstates capabilities not present in the supplied code chunk. There is no visible NLP processing, deduplication, or key-information extraction logic; the code mainly forwards search parameters to a remote API, normalizes a fixed set of fields, prints a summary, and saves JSON locally. Additionally, it writes files to the user's Desktop by default, which is a meaningful behavior not mentioned in the description. So the description does not accurately represent the actual implemented behavior of this chunk.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/search_cli.py (reported line 21)May include surrounding context.
python
from typing import Dict, Any, List, Optional from dotenv import load_dotenv # 加载 .env 文件 env_path = Path(__file__).parent.parent / ".env" load_dotenv(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/search_cli.py (reported line 226)May include surrounding context.
python
from typing import Dict, Any, List, Optional from dotenv import load_dotenv # 加载 .env 文件 env_path = Path(__file__).parent.parent / ".env" load_dotenv(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/search_cli.py (reported line 227)May include surrounding context.
python
from typing import Dict, Any, List, Optional from dotenv import load_dotenv # 加载 .env 文件 env_path = Path(__file__).parent.parent / ".env" load_dotenv(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/search_cli.py (reported line 228)May include surrounding context.
python
from typing import Dict, Any, List, Optional from dotenv import load_dotenv # 加载 .env 文件 env_path = Path(__file__).parent.parent / ".env" load_dotenv(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/search_cli.py (reported line 229)May include surrounding context.
python
from typing import Dict, Any, List, Optional from dotenv import load_dotenv # 加载 .env 文件 env_path = Path(__file__).parent.parent / ".env" load_dotenv(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/search_cli.py (reported line 22)May include surrounding context.
python
from dotenv import load_dotenv # 加载 .env 文件 env_path = Path(__file__).parent.parent / ".env" load_dotenv(env_path) # API配置

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and trigger terms are broad enough to match ordinary requests such as '搜索', '查找', '信息', or '查询', which can cause the skill to activate in situations the user did not clearly intend. In an agent environment, overbroad activation increases the chance of unintended web searches and downstream execution of the skill's workflow without explicit user awareness.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The instruction to run cat .env | grep FEEDAX_SEARCH_API_KEY causes the agent or user to read from a secrets file directly, normalizing secret-file access as part of routine execution. Even though it targets presence checking, this pattern can expose the API key value in terminal output, logs, transcripts, or agent telemetry if executed by an automated system.
Content: Scanner excerpt · skill.md (reported line 21)May include surrounding context.
检查配置

bash
cat .env | grep FEEDAX_SEARCH_API_KEY

如果未配置

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The execution flow repeats the practice of reading .env with cat to check for FEEDAX_SEARCH_API_KEY, again creating a path for credential disclosure through console output, logs, or conversation transcripts. In a skill intended for agent use, embedding this as a standard step makes secret exposure more likely because the agent may follow it automatically.
Content: Scanner excerpt · skill.md (reported line 291)May include surrounding context.
Step 1: 检查 API Key 配置

bash
cat .env | grep FEEDAX_SEARCH_API_KEY

如果返回空或文件不存在，提示用户前往 https://www.feedax.cn 申请

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users to configure and use a third-party service API key, but it does not clearly warn that user search queries and related parameters will be transmitted to an external web-monitoring provider. In a skill focused on intelligence gathering and public-content monitoring, queries may contain sensitive business interests, investigation targets, or personal data, so the omission can cause unintended data disclosure and privacy/compliance risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON file defines all category names and subcategories exclusively in Chinese, which can enforce a specific language/locale in downstream skill behavior. The file does not document that the taxonomy is intended only for Chinese-language use or offer any user opt-in or alternative locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The scene names are entirely specified in Chinese, which imposes a single language/locale in this configuration without any indication of user choice or documented regional justification. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings that force a specific language/locale for the tool's description and usage examples. Under the policy, a skill should not impose a language without offering user choice or clearly documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The client is configured to send API keys and search queries to a remote endpoint over plain HTTP, which provides no transport encryption or server authenticity. An attacker on the network path can intercept or modify requests and responses, exposing credentials and sensitive search activity or tampering with returned intelligence data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The CLI persists normalized search results and also includes search metadata/request parameters in a local JSON file by default. In an intelligence or monitoring workflow, queries, filters, and returned URLs/titles may be sensitive, so writing them to the Desktop without explicit opt-in increases the risk of unintended local disclosure to other users, backup systems, or endpoint monitoring tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script saves search results and request metadata to a JSON file on the user's Desktop without explicit consent or warning. In the context of public-opinion monitoring and intelligence analysis, even the existence of a query and its filters may reveal investigations, interests, or sensitive operational context to other local users or synced services.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The code performs external transmission of user-supplied search content and credentials to a third-party service. In this skill's context, external transmission is expected functionality, but it remains security-relevant because the transmitted material can contain sensitive monitoring targets, and here it is compounded by the use of insecure HTTP transport.
Content: Scanner excerpt · scripts/search_cli.py (reported line 428)May include surrounding context.
python
url = f"{self.base_url}{self.endpoint}" try: response = requests.post( url, json=payload, headers={

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill workflow states that complete search results are automatically saved to a desktop directory, but the description does not warn users about this local persistence. This can expose sensitive search topics, investigation subjects, or collected public-content datasets on disk without informed consent, especially on shared or monitored machines.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The JSON consists entirely of Chinese administrative region names, which reflects a fixed language/locale choice embedded in the asset. For a general-purpose skill asset, this can violate language/locale flexibility expectations because users are not offered any opt-in or alternative locale representation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency specification uses a lower-bound only constraint (requests>=2.28.0), which makes builds non-reproducible and allows installation of unexpected future versions. This is primarily a supply-chain hygiene weakness rather than an immediately exploitable flaw, but it can expose the skill to vulnerable or breaking releases depending on when it is installed.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0 python-dotenv>=1.0.0

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Vague Triggers

Credential Access

检查配置

如果未配置

Credential Access

Step 1: 检查 API Key 配置

Missing User Warnings

Undeclared Tool Scope

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

External Transmission

Missing User Warnings

Natural-Language Policy Violations

Unpinned Dependencies

Static analysis