Web Search powered by Aliyun IQS

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:41 AM UTC
• Version: 1.0.1

Overview

This is a straightforward Alibaba Cloud web-search skill, with ordinary third-party query and API-key privacy considerations.

Before installing, make sure you are comfortable sending search queries to Alibaba Cloud IQS and using an Alibaba Cloud API key. Avoid searching secrets, personal data, or confidential business text, and prefer a credential manager or a temporary environment variable instead of putting the API key in shell startup files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

API Key Stored in Plaintext Shell Startup Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-42
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code Snippet:

bash

export TONGXIAO_API_KEY='your-api-key-here'

The documentation then recommends persisting the credential:

bash

echo "export TONGXIAO_API_KEY='your-api-key-here'" >> ~/.zshrc
source ~/.zshrc

Technical Analysis

The setup instructions recommend writing the Alibaba Cloud IQS API key directly into a shell startup file such as ~/.zshrc or ~/.bashrc. This stores the credential as plaintext on disk and automatically exports it into every subsequently launched shell process.

Shell configuration files can be exposed through overly broad file permissions, compromised local processes, workstation backups, diagnostic archives, shell configuration synchronization, or accidental publication of dotfiles. Exporting the key also makes it available to child processes through their environment, increasing the number of processes and tools that may access the credential.

The project does not hardcode an actual credential, and exploitation requires a user to follow the documented persistence recommendation with a real API key.

Attack Path

1. A user replaces the placeholder with a valid Alibaba Cloud IQS API key and follows the documented command.
2. The key is written in plaintext to ~/.zshrc or an equivalent shell startup file.
3. A local malicious process, unauthorized user with file access, exposed backup, synchronized dotfile repository, or accidentally published configuration obtains the file.
4. The attacker extracts the API key from the exported environment-variable declaration.
5. The attacker submits authenticated requests to the Alibaba Cloud IQS service using the stolen key.

Impact Assessment

Successful exploitation exposes the user's IQS API credential. An attacker may issue API requests unde ...[truncated 426 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to place the API key directly in ~/.zshrc, ~/.bashrc, or other routinely synchronized configuration files.
• Prefer an operating-system credential manager, dedicated secret-management service, or platform-provided secret injection mechanism.
• If file-based loading is unavoidable, store the key in a dedicated file outside the project and dotfile repositories, restrict its permissions to the owner (for example, mode 0600), and load it only for the process that requires it.
• Avoid globally exporting the credential to every child process. Pass it only to the search command or its controlled execution environment.
• Add guidance warning users not to commit, synchronize, log, or include the key in support bundles and backups without suitable protection.
• Document immediate credential revocation and rotation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes shell commands and depends on external binaries (curl, jq), but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may execute shell-capable behavior without clear policy boundaries, increasing the risk of unintended command execution or broader host interaction than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation explains how to configure the API key and use the search service, but it does not clearly warn users that their queries are transmitted to Alibaba Cloud's external search API. This omission can lead to privacy and compliance issues if users or agents send sensitive prompts, personal data, or proprietary information off-system without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation guidance says to use the skill whenever the user needs internet retrieval, which is overly broad and lacks conditions around consent, data sensitivity, or when external search is appropriate. In an agent setting, this can cause the model to send arbitrary user prompts or confidential context to a third-party search service without adequate narrowing or review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented output format mandates Chinese field labels such as '标题', '链接', '摘要', and '正文', which indicates a fixed language convention in the skill documentation. There is no indication that users can opt into another language or that the Chinese-only format is required for a justified region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This shell script transmits user-supplied query data to a remote Alibaba Cloud endpoint and includes a credential in the request header. Although the code checks that the API key exists, it does not display any notice, confirmation, or warning to the user that their query will be sent over the network to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Comments, usage text, and error messages are all presented only in Chinese, which imposes a specific language/locale on users without opt-in. Under the stated policy, forcing a language without offering choice or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.