Metaso Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:42 PM UTC
• Version: 1.2.0

Overview

The skill is a coherent MetaSo search helper, but it recommends storing an API key in a plaintext local file without safety controls.

Review before installing. Use the METASO_API_KEY environment variable or a proper secret manager instead of the documented plaintext secrets file, and rotate the key if it has ever been saved in a shared, synced, backed-up, or version-controlled location.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

Plaintext API Key Storage Is Recommended

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–51
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Documentation

text

**Method 2** - Password document (recommended):
Add the following to `secrets/key存储文档.txt`:

text

Meta AI api：your_api_key_here

Technical Analysis

The skill documentation recommends storing the Meta AI API key in an ordinary plaintext file. It does not require encryption, restrictive filesystem permissions, placement outside the repository, exclusion from version control, or integration with an operating-system secret store.

Because the method is explicitly marked as recommended, users may choose it instead of the environment variable declared in skill.json. API keys are bearer credentials: any party that obtains the value can generally use it without possessing additional authentication factors.

Attack Path

1. A user follows the documented configuration procedure.
2. The user writes a valid API key to secrets/key存储文档.txt.
3. The file is exposed to another local user or process, included in a backup, indexed by a development tool, or accidentally committed to source control.
4. An unauthorized party retrieves the key from the plaintext file.
5. The unauthorized party submits requests to the Meta AI API using the compromised bearer credential.

Impact Assessment

Exploitation does not directly grant operating-system privileges. It grants the attacker the API access associated with the exposed key, potentially allowing unauthorized searches, consumption of the victim's API credits or quota, and access to any capabilities assigned to that credential. The scope is limited by the permissions and account limits attached to the compromised API key.

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to store API keys in a plaintext document.
2. Use the METASO_API_KEY environment variable or an operating-system credential manager.
3. If file-based storage must be supported:
   • Store the file outside the project and source-control directories.
   • Restrict access to the owning account using filesystem permissions.
   • Add the credential path to version-control ignore rules.
   • Prevent backup, logging, indexing, and diagnostic tools from collecting the file.
   • Validate permissions before reading the credential and refuse overly permissive files.
4. Document key rotation and immediate revocation procedures for suspected exposure.
5. Ensure the implementation never prints the key in logs, command output, or exception messages.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:45

Finding

Plaintext API Key Storage Guidance Is Repeated in the README

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 45–49
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Documentation

text

**Method 2** - Password document:
Add the following to `secrets/key存储文档.txt`:

text

Meta AI api：your_api_key_here

Technical Analysis

The README instructs users to put a bearer API key into a plaintext file without specifying encryption, access controls, source-control exclusions, or secure storage requirements. This duplicates the insecure credential-handling guidance in SKILL.md and increases the likelihood that users will adopt it.

Attack Path

1. A user reads the README and stores a valid key at the documented path.
2. The plaintext file becomes accessible through local filesystem access, repository synchronization, an accidental commit, backups, or indexing.
3. An unauthorized party copies the bearer credential.
4. The party authenticates to the external API as the affected user and consumes the account's authorized API resources.

Impact Assessment

The attacker can obtain the API privileges assigned to the exposed key, including unauthorized API usage and consumption of account quota or credits. This finding does not establish host-level privilege escalation. The maximum scope depends on the permissions and billing limits associated with the credential.

Remediation

View remediation

Remediation Suggestions

1. Remove the plaintext-file configuration instructions from the README.
2. Direct users to the METASO_API_KEY environment variable or a supported secret manager.
3. If a credential file remains supported, require restrictive permissions, keep it outside the repository, and explicitly exclude it from version control and backups.
4. Add instructions for revoking and rotating exposed keys.
5. Keep all credential guidance consistent across README.md, SKILL.md, and skill.json.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly instructs users to place an API key in a plaintext local document, which increases the risk of credential disclosure through accidental sharing, backups, sync tools, screenshots, or local compromise. While this is documentation rather than executable code, it promotes an insecure secret-handling practice that can directly lead to unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation explicitly recommends storing the API key in a plaintext local document, which increases the risk of credential disclosure through accidental sharing, backups, source control inclusion, or other local compromise. While this is presented as a convenience feature rather than an attack, it normalizes insecure secret handling and can directly expose the external service account tied to the key.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

Natural-language policy checks apply to all file types. The description explicitly markets the skill as a Chinese AI search engine and the tags reinforce a Chinese-language focus, but the manifest does not state that language is user-selectable or explain a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural language. The README presents the skill as a Chinese AI search experience and emphasizes Chinese optimization, but it does not state that this is an optional or region-specific mode nor offer users a language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural language. The description states 中文AI搜索引擎 and the feature list emphasizes 中文优化, but the document does not indicate that language selection is optional or explain a necessary region-specific constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a manifest file, so vague-trigger checks apply. The description presents the skill generally as a Chinese AI search engine but provides no explicit trigger phrases, scope boundaries, or exclusion conditions, which can make invocation criteria ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.