Security audit
Security checks for vulnerabilities and agentic risk
The search function fits its purpose, but its automatic recharge workflow installs payment software and handles payment details unsafely.
Before using automatic recharge, require separate approval for software installation and the exact payment, pin the payment package, and correct payment-field validation and shell handling. Search terms go to RedFox, so avoid confidential queries. Daily subscriptions continue until removed.
references/alipay-recharge.mdExternal payment metadata is interpolated into shell commands
An adversarial response provider can execute arbitrary local commands during payment preparation, before user approval in the payment application.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
)
try:
with urllib.request.urlopen(req, timeout=15) as resp:
result = json.loads(resp.read().decode("utf-8"))
except urllib.error.HTTPError as e:
body = e.read().decode("utf-8", errors="replace")
The documented workflow turns an insufficient-credit response into payment submission and automatic query resumption without requiring explicit approval of the charge. This crosses the authorization boundary between requesting search results and authorizing spending, using payment details supplied by an external API response. The referenced payment guide was not provided, so downstream safeguards cannot be verified, but this file itself establishes no approval gate or spending limit.
On an insufficient-credit response, the script emits mandatory instructions directing the agent to initiate and monitor an Alipay recharge using API-supplied payment links and amounts, without first obtaining explicit user authorization. A content-search request does not authorize a financial workflow, and trusting these response fields could expose the user to unwanted payment requests or phishing if the upstream response is compromised. The script itself does not execute a payment, and the provided material does not establish that Alipay's final confirmation can be bypassed.
The README identifies RedFoxHub as the API-key provider but does not explicitly disclose that search keywords will be transmitted to an external service. Users could consequently submit confidential campaign topics or other sensitive queries without understanding the disclosure; however, external processing is consistent with this search skill's purpose, and the supplied documentation does not establish malicious exfiltration or the provider's actual data-handling practices.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow instructs the agent to submit keywords extracted from the user's request through the search script. Although lines 249–272 document the Redfox API credentials and endpoint, the skill does not warn users that their search terms will be transmitted to redfox.hk, which matters when queries contain sensitive information.
The workflow directs the agent to install a missing CLI automatically, without an explicit approval step for executing downloaded code or making local system changes. A video-search request does not inherently authorize software installation, and allowing an API insufficient-balance response to trigger installation broadens the trust boundary beyond the original task.
The installation command uses the mutable @latest tag and npx -y, allowing newly published package code to run without an interactive installation prompt. A compromised package release could execute with the agent's local permissions and potentially access credentials or manipulate the payment workflow; this is a CLI supply-chain issue, not specifically an MCP-server issue.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.