fofa-query

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:55 PM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate FOFA search helper, but it enables broad internet reconnaissance and has credential-handling risks that deserve review before installation.

Install only if you intend to use FOFA for authorized asset research. Prefer FOFA_API_KEY from a protected environment or secret manager, do not pass credentials with --api-key, and use narrowly scoped queries tied to assets you own or are explicitly allowed to assess.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fofa_query.py:319

Finding

FOFA API Credential Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/fofa_query.py:319-323
Vulnerability Type: Command-line secret exposure
Risk Level: Medium

python

parser.add_argument(
    "--api-key",
    help="FOFA API 凭证（email:key 格式），不指定则从环境变量读取"
)

The supplied value is subsequently passed to the client:

python

client = FOFAQuery(api_key=args.api_key)

Technical Analysis

The script permits the FOFA email and API key to be supplied as a plaintext command-line argument, for example:

bash

python scripts/fofa_query.py --api-key '[e-mail]:secret-key' -q 'domain="example.com"'

Command-line arguments may be exposed through process inspection facilities, system monitoring and auditing tools, shell history, terminal logs, CI/CD logs, or Agent tool-call records. Consequently, users who select this supported authentication method may unintentionally disclose the complete FOFA credential.

The script already supports retrieving the credential from FOFA_API_KEY, so accepting the secret through the command line is unnecessary for its declared functionality and increases the local exposure surface.

The Base64 encoding at scripts/fofa_query.py:53-56 is not itself a confirmed exfiltration vulnerability. It constructs an authentication value that is placed in the Authorization header and sent over HTTPS exclusively to the fixed FOFA API endpoint. The encoded credential is not written to standard output by the reviewed code.

Attack Path

1. A user or Agent invokes the script using the supported --api-key option.
2. The plaintext email:key credential becomes part of the process command line.
3. The command is retained in shell history, execution logs, Agent tool-call logs, or system audit records, or is observed through local process inspection while running.
4. An attacker with access to one of those data sources extracts the credential.
5. The attacker reuses it to authenticate to the FOFA API.

This path requires local pro ...[truncated 687 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option and retrieve the credential exclusively from FOFA_API_KEY or an approved secret-management system.
2. If interactive credential entry is required, use getpass.getpass() so the secret is not echoed or placed in process arguments.
3. Explicitly document that credentials must never be supplied in shell commands, logs, query text, or Agent prompts.
4. Avoid logging complete command lines in automation that invokes the Skill.
5. If compatibility requires retaining --api-key, deprecate it immediately, display a security warning, and migrate callers to environment- or secret-manager-based authentication.
6. Rotate any FOFA credential previously supplied through command-line arguments if command histories or execution logs may have been retained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares access to environment variables and performs network-backed queries, but it does not define explicit tool scope or permission boundaries. That increases the chance an agent can invoke the skill in broader contexts than intended, including security-relevant asset discovery, without clear authorization gating or least-privilege controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger language is broad enough to match generic requests about security research, asset discovery, or finding vulnerable assets, which could cause the skill to activate for loosely scoped or potentially unauthorized reconnaissance tasks. In this context, the skill is specifically designed for internet asset search, so overbroad activation materially raises misuse risk rather than being merely descriptive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language descriptions, help text, and error messages that force a specific language/locale for all users. The policy allows locale constraints only when they are opt-in or clearly justified, which is not present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fofa_query.py (reported line 85)May include surrounding context.

python

if method.upper() == "GET":
                response = requests.get(url, params=params, headers=headers, timeout=30)
            else:
                response = requests.post(url, json=params, headers=headers, timeout=30)
            
            # 检查 HTTP 状态码
            if response.status_code >= 400:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill exposes account/profile retrieval and search-history access methods that go beyond the stated asset-query purpose. This expands data access to potentially sensitive user metadata and prior query activity, which may leak operator behavior or credentials-linked account information if invoked unintentionally or by a prompt-injected workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file presents all instructions and examples exclusively in Chinese, and there is no note offering alternative languages or explaining that the content is intentionally region- or language-specific. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.