Security audit

Langextract Search

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised web search and model-based extraction workflow, with ordinary privacy and supply-chain cautions but no artifact-backed malicious or deceptive behavior.

Install only if you are comfortable sending search terms and retrieved content to the configured search and model providers, including Volcengine if enabled or used as the model endpoint. Avoid confidential queries, review generated reports before relying on them, keep API keys in environment variables rather than literal config values, and prefer pinned dependencies or a reviewed requirements file for installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/search.py:669
Finding: Untrusted Search Content Is Passed Directly to an LLM, Enabling Indirect Prompt Injection
Content: View full analysis
max_content_length: if verbose: print(f"⚠️ 内容过长 ({len(combined_content)} 字符)，截断至 {max_content_length} 字符") combined_content = combined_content[:max_content_length] ``` That untrusted content is then interpolated directly into the extraction instruction and sent to the configured model endpoint: ```python extraction_prompt = f"""基于以下网络搜索结果（包含智谱、DuckDuckGo、火山引擎的结果），请提取结构化信息：搜索结果： {combined_content} 请提取以下信息： 1. 主要内容摘要 2. 关键点列表（3-5个） 3. 相关事实或数据 4. 来源或参考信息（如果有）请用清晰的格式输出。""" if verbose: print(f"\n🤖 正在调用 {model_provider} API...") headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" } payload = { "model": model_name, "messages": [ { "role": "user", "content": extraction_prompt } ], "temperature": 0.7, "max_tokens": 2000, "top_p": 0.9 } response = requests.post( f"{base_url}/chat/completions", headers=headers, json=payload, timeout=120 ) response.raise_for_status() ``` ### Technical Analysis Search titles, snippets, references, and remote answers are externally controlled data. An attacker can publish content containing instructions intended for a language model and attempt to make that conte ...[truncated 2720 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A description-behavior mismatch is security-relevant because users may approve or run the skill based on claimed functionality while the actual implementation does something materially different. In this context, the mismatch undermines informed consent and review, especially for a skill involving network queries, model processing, and file output, where hidden or omitted behavior could expose data or expand operational risk.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Untrusted web content from search results is concatenated directly into the LLM prompt for extraction. A malicious page can embed prompt-injection text that manipulates the model into ignoring the task, fabricating output, or exfiltrating sensitive context included elsewhere in the prompt or workflow.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises capabilities that imply network access, file persistence, shell execution, and environment use, but the manifest does not declare any tool scope or permissions boundary. That makes the effective trust boundary unclear and can lead users or hosts to invoke a skill with broader capabilities than expected, increasing the risk of unauthorized data access, persistence, or command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill describes sending user queries to external search providers but does not explicitly warn that those queries and related metadata may be transmitted to third parties. This is dangerous because users may unknowingly disclose sensitive prompts, internal terms, or research topics to outside services with separate logging and retention policies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code sends each prompt to a remote OpenAI-compatible API via chat.completions.create, which transmits user-provided content off-box. In this file there is no confirmation prompt, logging/print statement, or comment/docstring warning that prompts will be sent to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata says it integrates Zhipu Search, DuckDuckGo, and langextract, but the code also supports a third external service, Volcengine. This is a supply-chain transparency and user-consent issue: users may believe data only goes to the documented providers, while queries may also be sent to an additional vendor if flags/config enable it.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow forwards full user queries and collected content to remote services and later stores them locally, with no data minimization or sensitivity screening. In a search-and-extraction skill, users may input confidential topics, credentials, proprietary terms, or personal data that should not be transmitted or retained wholesale.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/search.py (reported line 433)May include surrounding context.
python
"stream": False } response = requests.post( url, headers=headers, json=payload,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script transmits user queries to Volcengine and forwards retrieved content to other external services, but outside verbose mode there is no explicit warning that user input and remote content leave the local environment. This can cause unintended disclosure of sensitive research topics, internal terms, or regulated data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The extraction stage is described as 'langextract', but the implementation directly sends the full aggregated search content to a generic chat completions endpoint defined by baseUrl. This mismatch hides the true trust boundary and can route sensitive content to arbitrary third-party model endpoints configured by the operator.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/search.py (reported line 703)May include surrounding context.
python
"top_p": 0.9 } response = requests.post( f"{base_url}/chat/completions", headers=headers, json=payload,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow persists raw search results, extracted content, and optionally full JSON to local files automatically, without a prominent warning in normal execution. This can leave sensitive user queries, retrieved material, and model outputs on disk where other users, backup systems, or later processes can access them.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language content in the manifest description and body is presented only in Chinese, which can amount to a language policy issue when no user opt-in or alternative language is offered. The file does not indicate that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation states that the workflow can save results, but it does not clearly warn that running the skill may create local files containing search results or extracted content. This can lead to unintended persistence of sensitive queries or model outputs on disk, especially in shared workspaces or environments with weak file hygiene.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: A natural-language policy issue applies because the file forces a specific language presentation for all users with no opt-in, alternative language, or stated region-specific justification. The content appears to be general search configuration guidance rather than a clearly China-only compliance or locale-bound tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file documents search integrations that send user queries to external providers and allows configuring credentials and proxies, but it does not include any user-facing warning about transmitting search terms or related data to third-party services. Under the markdown-file criteria for missing user warnings, privacy-impacting behavior should be disclosed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: A language-specific skill description can be a policy concern when it implicitly forces one language for all users without opt-in or justification. Here, the documentation uses only Chinese and does not indicate whether the skill is region-specific or provide an alternative language option.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents that search results and extracted information will be saved to local files, including a full JSON result. Because these outputs may contain user queries, retrieved content, or derived summaries, the description should explicitly warn users that data will be persisted on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file's user-visible natural language in the module and class docstrings is entirely in Chinese, with no indication that another language can be used. This can constitute a language policy issue when the skill presents a fixed language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The wrapper requires an api_key and uses it to initialize a remote API client, but the file does not include any warning or explanatory comment about handling sensitive credentials. For safety-oriented skill auditing, accessing and using credentials should have some visible disclosure unless already documented elsewhere.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.