cloudsway-search-tob

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:27 AM UTC
• Version: 1.0.0

Overview

The skill is a web search helper, but it handles its API key too loosely by sending it to a host chosen from environment configuration.

Review the configured Cloudsways base path carefully before installing or using this skill. Only use a trusted official hostname, avoid sending sensitive queries unless you intend to share them with the search provider, and prefer snippet-only searches unless full-page content is needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.sh:73

Finding

Bearer Credential Disclosure Through an Unrestricted API Destination

Content

View full analysis

Vulnerability Details

File Location: scripts/search.sh, lines 73–77
Vulnerability Type: Unrestricted credential destination
Risk Level: Medium

Vulnerable Code

bash

RESPONSE=$(curl -s -G \
    --url "https://${CLOUDSWAYS_BASE_PATH}/search/${CLOUDSWAYS_ENDPOINT}/smart" \
    --header "Authorization: Bearer ${CLOUDSWAYS_AK}" \
    --header "pragma: no-cache" \
    "${CURL_ARGS[@]}")

Technical Analysis

The script constructs the request URL from the environment-controlled CLOUDSWAYS_BASE_PATH value and unconditionally sends CLOUDSWAYS_AK to that destination as a bearer credential. It does not validate the resulting hostname against an allowlist of official Cloudsways service domains.

Consequently, any party capable of influencing the script's environment can select an attacker-controlled HTTPS host. The use of TLS does not prevent this disclosure because TLS only protects the connection to the selected host; it does not establish that the selected host is an authorized recipient of the credential.

The accompanying documentation requires users to configure the destination through CLOUDSWAYS_BASE_PATH, but it does not impose a hostname restriction. Although SKILL.md provides searchmcp.cloudsway.net as an MCP example, the shell script does not enforce that or another documented official domain.

Attack Path

1. An attacker influences environment configuration, a wrapper script, deployment settings, or copied setup instructions.
2. The attacker sets CLOUDSWAYS_BASE_PATH to an HTTPS host under their control.
3. A user or agent invokes scripts/search.sh with a search request.
4. The script connects to the attacker-selected host.
5. The request includes Authorization: Bearer ${CLOUDSWAYS_AK}.
6. The attacker captures the access key and the submitted search query.
7. Subject to the API key's server-side permissions, the attacker can replay the credential against the legitimate service.

Impact Assessment

Success ...[truncated 516 chars]

Remediation

View remediation

Remediation Suggestions

1. Hardcode the official API hostname when only one service destination is supported.
2. If destination configurability is required, validate the canonical hostname against a strict allowlist of documented Cloudsways domains before invoking curl.
3. Keep tenant, endpoint, and path identifiers separate from the network hostname; do not accept a complete credential destination through an unrestricted environment variable.
4. Reject values containing schemes, user-information components, ports, path separators, query delimiters, fragments, whitespace, control characters, or other URL metacharacters.
5. Fail closed when destination validation fails, and never attach the Authorization header to an unapproved host.
6. Consider using a restrictive curl configuration such as --proto '=https' and appropriate redirect controls. If redirects are enabled in the future, ensure credentials cannot be forwarded to another origin.
7. Document the exact approved hostname format and rotate the access key if it may previously have been sent to an untrusted destination.
8. Apply server-side least privilege, expiration, usage monitoring, and revocation controls to reduce the impact of credential disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares shell-capable behavior via local script execution (./scripts/search.sh) and required binaries (curl, jq) but does not define any tool/permission scope. In an agent environment, missing explicit scope can allow broader-than-intended execution paths and makes it harder to constrain what the skill is authorized to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill whenever up-to-date information, news, or deep research data is needed, which is broad enough to trigger on many generic user requests. Over-broad invocation increases the chance that user prompts and retrieved external content are sent to the third-party service unnecessarily, expanding privacy and prompt-injection exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly sends user queries to an external SmartSearch API and can retrieve full webpage content into the model context, but it does not provide a user-facing privacy warning or consent language. This can lead to unintentional disclosure of sensitive prompts, research topics, or retrieved data to a third party, especially because the skill is positioned for broad research use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.