Security audit
Security checks for vulnerabilities and agentic risk
This search skill needs review because its reports expose your API key to unsafe content, its local service lacks access controls, and searches can trigger payment setup without explicit approval.
Wait for corrected credential handling, safe report rendering, authenticated proxy access, and explicit approval before payment setup. If using the current package, CSV-only mode avoids the HTML report and local server. Searches send keywords to RedFox and consume API credits. Approve payment details and a pinned CLI installation separately. If reports already contain a live key, rotate it and remove those reports.
.External search content can execute JavaScript in the credential-bearing HTML report
Injected JavaScript can read the API key embedded in the same report, send it to an attacker, read report data, and invoke the authenticated local proxy. This is browser-side execution, not demonstrated operating-system code execution.
.Unauthenticated loopback proxy permits cross-origin use of the user's API account
An attacker can issue unauthorized searches, read their responses, and consume the user's API allowance or credits while the proxy remains running.
The core search and reporting behavior matches the description. However, emit_payment_required() only prints instructions and a structured payment-required payload; search_works() then terminates the process. No supplied executable logic invokes Alipay, monitors payment completion, or retries the original query. Those actions would require an external orchestrator or additional code not supplied. The third-party search API, credential loading, output files, and localhost report server are supporting implementation details rather than unrelated capabilities.
An insufficient-credit response triggers instructions to initiate and submit a payment workflow without establishing explicit user authorization for a purchase. This crosses the boundary between permission to search and permission to spend money, while relying on payment details supplied by an external response; the referenced workflow or payment tool might impose safeguards, but none are established in the supplied file.
On an insufficient-credit response, the script directs the consuming agent to initiate an Alipay workflow using the API-provided payment URL, amount, and merchant information without an explicit user-approval checkpoint. The script does not itself execute a payment, but its imperative output and the skill's automatic-recharge description can cause a search request to escalate into an unapproved financial action, especially if the upstream response is compromised or misleading.
The usage table presents phrases such as "Search for product review videos", "Show more results", and "Export CSV" as skill invocations, although these requests commonly apply to unrelated tasks. While the README describes a Toutiao search skill, it does not explicitly restrict these generic phrases to an already active Toutiao search session.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow directs users to run searches without clearly stating that their keywords are transmitted to Redfox, a third-party API provider rather than Toutiao directly. Although the API-key setup signals an external integration, users researching confidential brands, incidents, or unpublished plans may not understand that their search terms leave the local environment.
A content-search request can automatically escalate into downloading and executing an installer that modifies the local environment, without a separate approval step. The -y option suppresses npm's package-installation prompt, and authorizing a search does not necessarily authorize installation of payment software.
The installation instruction executes an npm package using the mutable @latest tag, so the code executed can change without review. A compromised release could execute with the agent's local permissions and access files or credentials; its placement in a payment workflow increases the sensitivity, although this is a CLI rather than an MCP server.
The workflow instructs the agent to submit the original cashier URL, product information, and amount to the payment-link service and then initiate payment handoff. Although these steps support the stated payment purpose, the instructions never require informing the user that their payment-link and order information will be sent to an external payment service.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Sending search parameters and the Redfox API key to the configured Redfox service is expected functionality, not inherently exfiltration. However, the surrounding localhost proxy accepts requests without authentication, adds the user's API key, and permits wildcard cross-origin access, allowing untrusted local clients—and potentially websites where browser controls permit localhost access—to consume paid API quota and read results through the user's credentials.
def _do_proxy_request(self, url, payload):
try:
resp = requests.post(url, json=payload,
headers={"Content-Type": "application/json", "X-API-KEY": self.api_key}, timeout=15)
self._send_json(resp.json())
except Exception as e:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if not args.no_open:
step("打开浏览器...")
try:
subprocess.run(["open", url], check=True)
except Exception:
print(f" 请手动打开: {url}")
Examples such as “搜一下测评类的视频” (search for review videos), “看更多结果” (see more results), and “导出 CSV” (export CSV) overlap with requests for many unrelated tools. Although the README describes a Toutiao skill, it does not require these generic phrases to occur within an already active Toutiao search session or provide exclusions for other contexts.