ClawHub
Back to skill

Security audit

Kagi

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Kagi search/FastGPT helper that sends user-provided queries to Kagi using a user-supplied API token.

Install only if you are comfortable giving the skill access to your Kagi API token and sending your search/FastGPT queries to Kagi. Do not include secrets or highly sensitive personal data in queries, and consider hardening the client to reject unexpected redirects before using it with valuable API credentials.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/kagi_client.py:41
Finding

API Authorization Token May Be Forwarded Across Redirect Boundaries

Content
View full analysis

Vulnerability Details

File Location: scripts/kagi_client.py, lines 41–54
Vulnerability Type: Credential exposure through unsafe automatic redirect handling
Risk Level: Medium

Vulnerable Code

python
headers = {
    "Authorization": f"Bot {_token()}",
    "Accept": "application/json",
}

data = None
if json_body is not None:
    data = json.dumps(json_body).encode("utf-8")
    headers["Content-Type"] = "application/json"

req = urllib.request.Request(url, method=method.upper(), headers=headers, data=data)

try:
    with urllib.request.urlopen(req, timeout=timeout) as resp:

Technical Analysis

The client adds the Kagi API token to the HTTP Authorization header and invokes urllib.request.urlopen, which uses automatic redirect handling. The implementation does not reject redirects or validate the scheme and hostname of a redirect destination.

Consequently, a redirect response could cause a credential-bearing request to cross the intended https://kagi.com origin boundary. An attacker must first be able to influence the authenticated endpoint's redirect response, such as through compromise of the remote service or another network condition capable of producing a trusted HTTPS response. Ordinary network interception without a valid TLS trust path is insufficient.

Attack Path

  1. A user invokes kagi_search.py or kagi_fastgpt.py.
  2. _request reads KAGI_API_TOKEN or KAGI_API_KEY and inserts it into the Authorization header.
  3. The authenticated Kagi endpoint returns an attacker-controlled redirect to another origin.
  4. The standard-library redirect handler follows the redirect without an application-level destination allowlist.
  5. If the authorization header is retained by the applicable Python runtime and redirect flow, the attacker-controlled destination receives the Kagi API token.
  6. The attacker reuses the token to make unauthorized Kagi API requests.

...[truncated 490 chars]

Remediation
View remediation

Remediation Suggestions

Disable automatic redirects for authenticated API requests and reject unexpected 3xx responses. If redirects are operationally required, implement a custom redirect handler that:

  1. Allows only HTTPS destinations.
  2. Compares normalized destination hostnames against an explicit allowlist, such as kagi.com.
  3. Removes Authorization, cookies, and other sensitive headers before any cross-origin redirect.
  4. Rejects HTTPS-to-HTTP downgrades.
  5. Limits the number of redirects to prevent redirect loops.
  6. Records a sanitized error without logging the token or complete sensitive response data.

Prefer treating every origin change as an authentication boundary. Construct a new request after validating an allowed redirect rather than automatically reusing the original request headers.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/kagi-api.md (reported line 29)May include surrounding context.

Example:

bash
curl -H "Authorization: Bot $KAGI_API_TOKEN" \
  "https://kagi.com/api/v0/search?q=steve+jobs"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This Python file makes a remote FastGPT API call using the user-provided query, which transmits user input over the network. The script includes no confirmation prompt, no user-facing notice at execution time, and no inline comment or docstring warning that the query is sent to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.