360智搜(网页搜索 图片搜索 新闻搜索等)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:11 AM UTC
• Version: 1.3.1

Overview

This is a disclosed Chinese web-search skill that sends search queries to 360’s API, with caution needed around broad activation and API-key setup.

Install only if you intend to use 360’s search APIs for Chinese/current-information queries. Avoid putting paid API keys directly in shell history or broadly inherited profile files when possible; prefer a secret manager or app-scoped environment variable, and remember that search terms, session IDs, and image-search inputs may be sent to api.360.cn.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Plaintext API Key Persistence in Shell Profiles and User Environment

Content

View full analysis

"' >> ~/.bashrc && source ~/.bashrc echo 'export SEARCH_360_API_KEY=""' >> ~/.zshrc && source ~/.zshrc setx SEARCH_360_API_KEY "" ``` ### Technical Analysis The documented setup procedure embeds the API key directly in a command and writes it to a persistent shell profile or the Windows user environment. On Unix-like systems, the literal command may also remain in shell history. The secret can consequently be exposed through profile files, command history, backups, diagnostic collection, or unrelated descendant processes that inherit the environment. The procedure conflicts with the declaration that the Skill does not write to the filesystem. The project manifest also declares only a network side effect and does not disclose persistent credential configuration. Running `source ~/.bashrc` or `source ~/.zshrc` is unnecessary for securely configuring this individual application and executes every command currently present in the profile. Although exploitation requires access to the affected user account, profile, process environment, backup, or history, the instructions unnecessarily increase the API key's exposure. ### Attack Path 1. A user follows the documented setup instructions and substitutes a valid 360 API key into the command. 2. The command persists the key in `.bashrc`, `.zshrc`, or the Windows user environment. The command may also be retained in shell history. 3. A local process, another ...[truncated 854 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

�� API 密钥**

1. 访问 https://ai.360.com/platform 并登录（新用户注册即获赠 50 元体验金）
2. 进入**「开放平台」→「API Key 管理」**
3. 创建应用并复制密钥字符串

第二步——设置环境变量

根据操作系统选择对应方式，将 替换为你的密钥 换成实际密钥字符串：

• Linux（bash）——在终端运行：

bash

echo 'export SEARCH_360_API_KEY="替换为你的密钥"' >> ~/.bashrc && source ~/.bashrc

• macOS（zsh，默认 shell）——在终端运行：

bash

echo 'export SEARCH_360_API_KEY="替换为你的密钥"' >> ~/.zshrc && source ~/.zshrc

• Windows（PowerShell）——运行以下命令写入用户环境变量，需重开终端后生效：

powershell

setx SEARCH_360_API_KEY "替换为你的密钥"

第三步——重启应用

完全退出并重新打开应用，使环境变量生效。配置完成后，技能将自动响应搜索请求。

---

接口选�

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases are extremely broad and map to common conversational terms such as '搜索', '最新', '今天', and '帮我找', which can cause the skill to activate for many unrelated requests. In this context, that can route user prompts, queries, and potentially sensitive context to an external search provider without clear user intent, increasing privacy risk and unintended tool invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example trigger phrases are ordinary, high-frequency user requests like searching news, market updates, and product releases. In a skill-selection system, such broad phrasing can cause this skill to activate too often, potentially overriding safer or more appropriate tools and expanding external data access without clear user intent for this specific provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to prefer this provider over the built-in browser for Chinese or China-related queries, without explicit user opt-in. That creates a policy-bypass and privacy risk because user queries may be routed to a specific third-party/localized search engine based on language or topic rather than informed consent or least-privilege tool choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill declares very broad trigger phrases such as '搜索', '查一下', '最新', '今天', and '最近', which overlap with common user language and can cause the agent to invoke this external-search skill for routine requests without clear user intent. In context, that increases unnecessary data transmission to a third-party search provider and can override safer/default tooling selection.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

请求示例：

bash

curl --location --request GET 'https://api.360.cn/v2/mwebsearch?q=植物&ref_prom=aiso-sr&sid=test.by.curl' \
--header 'Authorization: here.is.your.apikey' \
--header 'Content-Type: application/json'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

请求示例：

bash

curl --location --request GET 'https://api.360.cn/v2/mwebsearch?q=植物&ref_prom=aiso-sr&sid=test.by.curl' \
--header 'Authorization: here.is.your.apikey' \
--header 'Content-Type: application/json'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

请求示例：

bash

curl --location --request GET 'https://api.360.cn/v2/mwebsearch?q=植物&ref_prom=aiso-sr&sid=test.by.curl' \
--header 'Authorization: here.is.your.apikey' \
--header 'Content-Type: application/json'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

请求示例：

bash

curl --location 'https://api.360.cn/v1/search/aisearch' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer your-api-key-value' \
--data '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description explicitly limits the skill to "实时中文网页搜索," indicating a fixed language/locale behavior. The manifest does not mention any user language choice, opt-in, or clear policy justification for restricting operation to Chinese-only behavior.

Content

No source excerpt is available for this finding.

Scope Creep

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest declares no permissions even though the skill explicitly performs network calls and depends on an API key from the environment. This creates a transparency and policy-enforcement gap: users, hosts, or automated reviewers may underestimate the skill's capabilities, making secret access and outbound communication less visible than they should be.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.