Security audit

Pangolinfo AI SERP: AI Mode Output + AI Overviews

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its search-and-trends purpose, but it needs review because it directs handling of a raw Pangolinfo API key in ways that can expose the credential.

Review this skill before installing. Use a narrowly scoped Pangolinfo key, prefer Authorization headers or a protected MCP secret store, avoid putting API keys in URLs or command lines, and rotate any key that may already have appeared in URLs, logs, traces, or screenshots. No destructive behavior or exfiltration was found in the artifact.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:146
Finding: Agent-Accessible API Credential Violates Least-Privilege Boundaries
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:147
Finding: API Key May Be Exposed Through URL Query-String Authentication
Content: View full analysis
or the HTTP header Authorization: Bearer . ``` ```text MCP form: write the key into ~/.pangolinfo/config.json, use the MCP URL ?api_key=eyJhbGci..., or use the Authorization: Bearer eyJhbGci... header. ``` ```text MCP side uses CLI/config/URL (?api_key= or Authorization: Bearer ). ``` ### Technical Analysis The documented configuration permits a JWT API key to be placed in a URL query parameter using `?api_key=`. Query strings are routinely recorded by infrastructure components, including browser history, reverse proxies, load balancers, access logs, monitoring systems, analytics platforms, diagnostic traces, and copied connection strings. They may also be disclosed through screenshots or support bundles. A JWT placed in a query string is a bearer credential: possession can be sufficient for authentication. Unlike an authorization header, a query parameter is part of the URL and therefore has a substantially larger accidental-exposure surface. The document also describes the safer `Authorization: Bearer ` option, but presenting query-string authentication as an equivalent supported configuration encourages an insecure deployment pattern. ### Attack Path 1. A user follows the documented setup and creates a hosted MCP URL containing `?api_key=`. 2. The complete URL passes through a client, proxy, gateway, monitoring service, or access-logging component. 3. One or more components retain the full query string in logs, history, telemetry, screenshots, or diagnostics. 4. An attacker or unauthorized operator obtains access to one of those retained records. 5. The attacker extracts the JWT from t ...[truncated 631 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: At L018 the documentation explicitly says this MCP-native skill has '无 API key 环境变量' (no API key environment variable). However, the same file later states that in skill mode the AI reads the API key from environment variable PANGOLINFO_API_KEY (L146, L156, L368). This is a direct mismatch between the skill's stated operating model and its documented actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Line L118 states that the report language must match the user's question language. This is a language-handling policy constraint expressed as a hard rule, and the file does not indicate that users may override it or opt into a different reporting language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L163 says the report language must be consistent with the user's question language. Because this is phrased as a mandatory rule and does not offer an explicit alternative, it fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.