T08 · Insecure Dependencies
Warning
- Location
scripts/install.py:41- Finding
Unpinned Third-Party Package Installation and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Multi-Web-Search | 多引擎网页搜索
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent web-search skill, but it needs review because it can expose proxy credentials in output/cache and installs an unpinned third-party package into the user environment.
Install only if you are comfortable with queries being sent to third-party search engines. Avoid putting credentials in --proxy URLs, consider using --no-cache for sensitive searches, and install ddgs in an isolated environment with pinned versions rather than running the bundled installer directly.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/search.py:696- Finding
Proxy Credentials May Be Exposed in Plaintext Output and Cache Files
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/url_builder.py:107- Finding
Unvalidated Region Value Can Inject Downstream Tool-Call Syntax
- Content
View full analysis
str: """ 构建 DuckDuckGo Lite URL。 用于 web_fetch 方式的无 API 搜索。 """ encoded_query = url_encode(query) return f"https://lite.duckduckgo.com/lite/?q={encoded_query}&kl={region}" ``` The generated URL is embedded in executable-looking tool-call text: ```python return { "provider": "duckduckgo-lite", "url": url, "query": query, "region": region, "instructions": f'web_fetch(url="{url}", extractMode="text", maxChars=8000)' } ``` The CLI accepts arbitrary region text rather than enforcing the configured region list: ```python parser.add_argument("--region", "-r", default="us-en", help="地区代码（默认: us-en）") ``` ### Technical Analysis The query itself is URL encoded, but `region` is interpolated directly into the URL. Because the CLI does not constrain this argument to the region identifiers declared in `constants.py`, an attacker can supply quotation marks, delimiters, line breaks, or Agent-oriented text. The resulting URL is then inserted inside a string formatted to resemble a `web_fetch` tool invocation. This Python code does not execute that string itself. Exploitation therefore depends on a downstream Agent, orchestrator, or integration treating the returned `instructions` field as trusted tool-call syntax rather than inert data. This is a data-to-instruction boundary flaw. Structured data controlled by the caller can alter the apparent syntax of a generated instruction. ### Attack Path 1. An attacker controls or influences the `--region` argument. 2. The attacker supplies a crafted value containing ...[truncated 999 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python capture_output=True, text=True, timeout=5, env={**os.environ, "HTTPX_DISABLE_HTTP2": "1"} ) return result.returncode == 0 except (FileNotFoundError, subprocess.TimeoutExpired):
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python capture_output=True, text=True, timeout=5, env={**os.environ, "HTTPX_DISABLE_HTTP2": "1"} ) return result.returncode == 0 except (FileNotFoundError, subprocess.TimeoutExpired):
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python capture_output=True, text=True, timeout=5, env={**os.environ, "HTTPX_DISABLE_HTTP2": "1"} ) return result.returncode == 0 except (FileNotFoundError, subprocess.TimeoutExpired):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The changelog content from L08 onward is written in Chinese, with no indication that language selection is optional or that the skill is intentionally region-specific. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad and include common user intents like '搜索一下', '帮我搜', '技术文档', and '最新新闻', which can cause this skill to activate in many ordinary conversations. Because the skill performs live web searches and may route queries to third-party engines or through proxies, over-triggering can unintentionally exfiltrate user queries and cause unintended network actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill promotes 'free' and 'privacy-friendly' search but does not clearly warn that user queries are transmitted to external search engines such as Google, Baidu, Bing, Brave, or DuckDuckGo. In this context, users may reasonably assume searches are local or privacy-preserving, when in fact sensitive prompts, domains, and possibly proxy metadata may be disclosed to third parties.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(cmd, check=True): print(f" → {' '.join(cmd)}") result = subprocess.run(cmd, check=check, capture_output=True, text=True) if result.stdout: for line in result.stdout.decode().strip().split("\n"): if line.strip():
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print("\n🧪 Quick test (DuckDuckGo Lite fallback)...") search_script = os.path.join(script_dir, "search.py") if os.path.exists(search_script): result = subprocess.run( [sys.executable, search_script, "-q", "test", "-m", "1", "--lite"], capture_output=True, text=True, timeout=15 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 6. Try ddgs test if ddgs_path or shutil.which("ddgs"): print("\n🧪 Quick test (ddgs)...") result = subprocess.run( [sys.executable, search_script, "-q", "test", "-m", "1", "-b", "duckduckgo"], capture_output=True, text=True, timeout=15 )
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains user-facing natural-language documentation that assumes Chinese as the required language. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and CLI help present DHT as a real acceleration feature, but the runtime only toggles a boolean flag and reports it in output. No command-line argument, environment variable, or alternate execution path uses DHT to change how searches are performed, so the documentation overstates implemented behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file presents the fallback path as URL generation/web_fetch guidance, but later performs live HTTP requests and HTML parsing itself. That mismatch weakens user consent and trust boundaries, because queries and fetched pages are transmitted to third parties even when the interface implies a safer or more controlled fallback behavior.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_ddgs_available() -> bool: """检查 ddgs CLI 是否可用""" try: result = subprocess.run( [DDGS_CLI, "version"], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_dht_available() -> bool: """检查 DHT 网络是否可用（需要 ddgs[dht]）""" try: result = subprocess.run( [DDGS_CLI, "--help"], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python for attempt in range(max_retries): try: env = _build_env() result = subprocess.run( cmd, capture_output=True, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This skill sends user search queries and, in fallback mode, may fetch and parse result pages from external services without a prominent user-facing warning or consent mechanism. In an agent setting, queries often contain sensitive prompts, internal identifiers, or investigative targets, so silent external transmission creates meaningful privacy and data-leakage risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file contains natural-language documentation and printed messages exclusively in Chinese, such as the module description and usage notes. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a language/locale policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill routes Wikipedia searches specifically to en.wikipedia.org, which imposes an English-language choice in configuration without any visible user opt-in or locale selection. This is a natural-language policy concern because it fixes a language preference rather than allowing the user to choose or documenting a justified regional constraint.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This JSON manifest states that the skill will perform an "automatic fallback to web_fetch" when ddgs is unavailable, but it does not define the exact conditions, limits, or exclusions for when that fallback occurs. In a manifest file, this kind of broad activation behavior can be ambiguous and may lead to unintended invocation of alternate retrieval mechanisms.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The module docstring and surrounding comments present the skill's descriptive text exclusively in Chinese. Under the policy, forcing a specific language without offering choice or documenting a justified locale constraint is a natural-language policy concern.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring says the installer "Verifies all scripts are runnable". In practice, the code in the verification step only uses os.path.exists() for a fixed list of scripts and never checks execute permissions, shebang validity, or whether the scripts can actually run; only search.py is later test-executed.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The installer automatically performs a pip install from the network, which modifies the user's environment and introduces supply-chain risk without an explicit consent step. In a skill-install context, unexpected package installation can surprise users and may execute third-party package code during installation if the package or dependency chain is compromised.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The installer runs quick tests that perform outbound search requests without clearly warning the user first. While the requests are low sensitivity, automatic network activity during installation can leak metadata such as IP address and usage patterns, and is riskier in restricted or privacy-sensitive environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The primary docstring, comments, and many CLI help strings are presented in Chinese, which can impose a specific language on users without indicating that alternatives are available. The policy allows locale constraints when explicitly justified or optional, but no such opt-in or justification appears here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains natural-language documentation entirely in Chinese, including the module description and later user-facing output labels, with no indication that users can choose another language. The policy requires flagging language or locale constraints when a specific language is imposed without user opt-in.
- Content
Static analysis
No suspicious patterns detected.