T08 · Insecure Dependencies
Warning
- Location
SKILL.md:58- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
豆包WebSearch
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Doubao web search helper that sends search queries to RedFox using a configured API key, with some privacy and dependency cautions but no evidence of hidden or malicious behavior.
Install only if you are comfortable sending your search queries to RedFox/Doubao and using a REDFOX_API_KEY from your environment. Avoid putting secrets, credentials, regulated data, or confidential business text in searches, and consider installing dependencies in an isolated environment with pinned versions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/doubao_search.py:39- Finding
Search Queries Exposed Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tainted flow: 'headers' from os.environ.get (line 47, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python # ── Step 1: 提交搜索 ────────────────────────────────────────────── try: submit_resp = requests.post( f"{API_BASE}/submit", json={"inquiry_text": query, "source": source}, headers=headers,
Tainted flow: 'headers' from os.environ.get (line 47, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python time.sleep(POLL_INTERVAL) try: result_resp = requests.post( f"{API_BASE}/result", json={"taskId": task_id}, headers=headers,
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill performs network access and uses an environment-sourced API key, but it does not declare any explicit tool scope or permissions boundary. This makes the capability less transparent to the host agent and user, increasing the risk of unintended external requests or secret use without clear authorization controls.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes broad phrases like '联网搜索' and 'AI搜索', which can overlap with normal conversation and cause the skill to activate unexpectedly. Unexpected activation is risky here because the skill can transmit user queries to an external service and consume configured credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes external API usage, but it does not clearly warn users that their search queries will be transmitted to a third-party service. This creates a privacy and data-handling risk, particularly if users include sensitive, proprietary, or personal information in search requests.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The script sends user-provided search content and a source identifier to an external network service. In this skill's context, outbound transmission is core functionality, but it still creates privacy and data-governance risk because users may unknowingly submit sensitive information to a third-party API.
- Content
python # ── Step 1: 提交搜索 ────────────────────────────────────────────── try: submit_resp = requests.post( f"{API_BASE}/submit", json={"inquiry_text": query, "source": source}, headers=headers,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The tool transmits the user's search query to a third-party API endpoint without any explicit runtime warning, consent check, or guard against sending sensitive data. In an agent/skill context, users may assume a local search helper while actually disclosing prompts, identifiers, or confidential business data to an external service provider.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python time.sleep(POLL_INTERVAL) try: result_resp = requests.post( f"{API_BASE}/result", json={"taskId": task_id}, headers=headers,
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's documentation and runtime messages are written exclusively in Chinese, which enforces a specific language for all users. The file does not offer any language selection, fallback, or documented locale justification.
- Content