Security audit

360 Web Search

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent 360 web search skill, but users should understand that broad search triggers may send queries to 360's API and that its API key setup stores a key persistently.

Install only if you intend to use 360's API for web search. Treat searches as third-party network requests, avoid sensitive or regulated content in queries, prefer a scoped or quota-limited API key, and consider storing the key in a credential manager instead of shell startup files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:75
Finding: API Key Persisted in Plaintext User Configuration
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 75–87
Vulnerability Type: Plaintext credential storage
Risk Level: Medium

The following commands are provided for persisting the API key. The placeholder has been normalized to English without changing the commands' behavior:

bash
echo 'export SEARCH_360_API_KEY="replace-with-your-key"' >> ~/.bashrc && source ~/.bashrc echo 'export SEARCH_360_API_KEY="replace-with-your-key"' >> ~/.zshrc && source ~/.zshrc setx SEARCH_360_API_KEY "replace-with-your-key"

Technical Analysis

The installation instructions direct users to place SEARCH_360_API_KEY in plaintext shell initialization files on Linux and macOS or in a persistent user environment variable on Windows. Shell initialization files are not purpose-built secret stores and may be exposed through local backups, diagnostic bundles, accidental repository commits, support archives, or other processes operating under the same user account.

Sourcing the complete shell initialization file immediately after modification also executes every command already present in that file, which is unnecessary for configuring the current skill. The persistent filesystem write additionally conflicts with the statement at SKILL.md:35 that the skill does not write to the filesystem.

No hardcoded credential was found in the package itself. Exploitation depends on a user following these setup instructions and an attacker subsequently obtaining local read access, access to exported environment data, or access to a copied configuration file.

Attack Path

A user replaces the placeholder with a valid 360 API key and runs one of the documented commands.

The credential is stored persistently in plaintext in a shell profile or the user's persistent environment.

A local process, another actor with access to the user's files or environment, a backup collector, or an accidentally publis ...[truncated 846 chars]
Remediation: View remediation
Remediation Suggestions

Store the API key in an operating-system credential manager, an agent-managed secret vault, or another dedicated secret-management facility.

Retrieve the credential only at runtime and avoid printing it in commands, logs, error messages, generated files, or user-facing output.

If file-backed configuration is unavoidable, place the key in a dedicated file outside the project directory, restrict permissions to the owning user, and ensure the file is excluded from source control, backups where appropriate, and diagnostic collection.

Avoid appending secrets directly to .bashrc or .zshrc. Do not instruct users to source their entire startup file as part of key configuration.

On Windows, prefer Credential Manager or an equivalent protected secret store instead of a persistent plaintext environment variable.

Correct the security declaration so that it accurately discloses any persistent configuration write required by the documented setup process.

Document key rotation and revocation procedures, and recommend using a narrowly scoped key with quota or billing limits where the provider supports them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
�� API 密钥**

访问 https://ai.360.com/platform 并登录（新用户注册即获赠 50 元体验金）

进入**「开放平台」→「API Key 管理」**

创建应用并复制密钥字符串

第二步——设置环境变量

根据操作系统选择对应方式，将 替换为你的密钥 换成实际密钥字符串：

Linux（bash）——在终端运行：

bash
echo 'export SEARCH_360_API_KEY="替换为你的密钥"' >> ~/.bashrc && source ~/.bashrc

macOS（zsh，默认 shell）——在终端运行：

bash
echo 'export SEARCH_360_API_KEY="替换为你的密钥"' >> ~/.zshrc && source ~/.zshrc

Windows（PowerShell）——运行以下命令写入用户环境变量，需重开终端后生效：

powershell
setx SEARCH_360_API_KEY "替换为你的密钥"

第三步——重启应用

完全退出并重新打开应用，使环境变量生效。配置完成后，技能将自动响应搜索请求。

接口选�

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list contains very generic phrases such as “搜索”, “查一下”, “今天”, and “最近”, which are common in ordinary conversation and can cause unintended skill invocation. In an agent setting, this can reroute user requests to an external networked search tool without sufficiently explicit user intent, increasing privacy exposure and creating tool-selection confusion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README describes the skill as a real-time web search tool but does not clearly disclose that user queries are transmitted to a third-party service, 360 Search API. This creates a privacy and data-handling risk because users may provide sensitive prompts under the assumption the tool behaves like a local or first-party capability, especially in enterprise or regulated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 技能的触发条件包含“搜索”“查一下”“今天”“最近”等高频、宽泛表达，容易在普通对话中被误触发。由于该技能会向外部搜索服务发送用户查询内容，误触发会造成非预期的数据外传、增加费用消耗，并可能绕过用户对是否联网的预期。
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: 文档说明并示例了向 https://api.360.cn/v2/mwebsearch 发起带查询词和鉴权头的外部请求，这会将用户搜索词和相关标识发送给第三方服务。对搜索类技能而言这是功能所必需，但依然构成真实的数据出境/外传面，尤其当查询包含个人、企业或内部敏感信息时。
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
请求示例：

bash
curl --location --request GET 'https://api.360.cn/v2/mwebsearch?q=植物&ref_prom=aiso-sr&sid=test.by.curl' \ --header 'Authorization: here.is.your.apikey' \ --header 'Content-Type: application/json'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: 该处继续定义网页搜索接口的外部调用参数，包含 q、sid，并支持 client_ip、user_id 等字段。技能上下文使其更值得关注，因为它不仅外传查询词，还提供传输用户 IP 和标识符的能力，扩大了隐私暴露面。
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
请求示例：

bash
https://api.360.cn/v2/mwebsearch?q=植物为什么是绿色&ref_prom=aiso-sr&sid=x-demo-doc-test-x

必填参数：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: 此处与 AI 搜索接口示例相关，除返回搜索结果外，还可能把用户问题交给带大模型总结能力的第三方服务处理。相比普通搜索，这增加了更丰富上下文被外部处理的可能性，因此数据暴露和合规风险更高。
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
请求示例：

bash
curl --location 'https://api.360.cn/v1/search/aisearch' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer your-api-key-value' \ --data '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: 此处与 AI 搜索接口示例相关，除返回搜索结果外，还可能把用户问题交给带大模型总结能力的第三方服务处理。相比普通搜索，这增加了更丰富上下文被外部处理的可能性，因此数据暴露和合规风险更高。
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
请求示例：

bash
curl --location 'https://api.360.cn/v1/search/aisearch' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer your-api-key-value' \ --data '{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Natural-language content repeatedly specifies Chinese usage, including "实时中文网页搜索" and exclusively Chinese trigger phrases, but does not indicate that users can opt into another language or that the locale restriction is required by policy or region-specific compliance. This creates a language/locale policy concern because the skill appears to assume a fixed language by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

接口选�

Vague Triggers

Missing User Warnings

Vague Triggers

External Transmission

External Transmission

External Transmission

External Transmission

Natural-Language Policy Violations

Static analysis