Security audit

liuyuxin - Local Guide

Security checks for vulnerabilities and agentic risk

Overview

This local guide skill has a coherent purpose, but its search helper can execute user-influenced search text through a shell command if a fallback path is used.

Review before installing. Do not use this version unless you trust the publisher and understand the risk from the shell-based search fallback; the maintainer should replace shell=True with safe argument passing or a direct API call. Store EXA and Feishu credentials securely, avoid putting real keys in shared dotfiles or logs, and only configure Feishu if you are comfortable sending recommendation content to that workspace.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: # 兜底实现 import subprocess cmd = f"mcporter call exa.web_search_exa query='{query}' numResults={num_results}" result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout
Confidence: 98% confidence
Finding: The fallback path builds a shell command with the user-influenced query interpolated directly into a string and executes it with shell=True. This enables command injection: an attacker can craft query text containing shell metacharacters to execute arbitrary commands in the agent environment.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The file adds Feishu messaging capability that is not obviously necessary for a skill described as local recommendation/search. Extra outbound messaging functionality increases the attack surface, enables unannounced data transmission to external chats, and makes the skill context more suspicious because it can be used to relay results or user data off-platform.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The fallback implementation is not merely a search wrapper; it spawns a shell and passes unsanitized, user-controlled content into that shell command. In the context of a recommendation/search skill, this execution capability is unnecessary and materially expands the attack surface beyond the stated purpose.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README explicitly tells users to persist the EXA API key into ~/.bashrc, which increases the chance the secret is exposed through shared shell profiles, backups, screenshots, dotfile sync, or accidental disclosure. This is not malware, but it is insecure secret-handling guidance because it normalizes long-lived credential storage without warning users about sensitivity or safer alternatives.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README documents FEISHU_APP_ID and FEISHU_APP_SECRET setup but provides no warning that these values control access to Feishu integrations and may affect account security and privacy if leaked. In context, this is unsafe operational guidance rather than an active exploit, but it can lead users to mishandle application secrets.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instructions tell users to set and persist EXA_API_KEY, including echoing it into shell startup files, without warning that the value is a secret or advising safer handling. This can lead to accidental exposure through shell history, shared profiles, screenshots, logs, or insecure workstation practices, enabling unauthorized API usage and quota/billing abuse.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: User-influenced query data reaches a shell execution path without any warning, approval gate, or sanitization. The lack of confirmation is not the core issue by itself, but in combination with shell execution it means normal search input can become arbitrary command execution without the user's awareness.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This script sends user-derived recommendation content to Feishu via `send_card` without any user-facing disclosure, consent check, or data minimization in this file. Because the card can include addresses, phone numbers, navigation details, and other potentially sensitive or proprietary recommendation data, users may not realize their search results are being transmitted to a third-party messaging platform.

Static analysis

No suspicious patterns detected.