Felo Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

The skill provides the advertised Felo web search function, but it can over-trigger on ordinary questions and send prompt text to a third-party API while using unsafe command examples for secrets and temporary files.

Review before installing. This skill sends search queries to Felo using your API key, and its broad auto-trigger rules may send more prompts than you expect. Avoid using it with secrets, private code, personal data, or confidential business context unless you explicitly intend that text to go to Felo. Prefer a pinned installer, avoid printing API keys, and replace the fixed /tmp JSON examples with safer request construction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: README.md:36

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Remediation

View remediation

...`. - Publish and verify package integrity information, signatures, or trusted provenance before execution. - Use a lockfile and an approved registry where the installation workflow supports them. - Avoid automatic execution of newly downloaded packages. Prefer downloading, inspecting, and then running a verified artifact. - Document the expected package publisher, version, checksum, and verification procedure. - In automated environments, configure npm to reject unexpected registries and prevent lifecycle scripts unless they are explicitly required and reviewed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:82

Finding

API Key Exposed Through Terminal Output

Content

View full analysis

`. ### Impact Assessment Exploitation exposes the Felo API credential rather than granting direct operating-system privileges. An attacker may consume the victim's API quota, issue requests under the victim's account, incur usage charges where applicable, or access any API capabilities authorized to that key. The exact service-side scope depends on the permissions assigned by Felo. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:89

Finding

Predictable Shared Temporary File Allows Symlink Clobbering and Data Collisions

Content

View full analysis

/tmp/felo_query.json << 'EOF' {"query": "USER_QUERY_HERE"} EOF # Call Felo API curl -s -X POST https://openapi.felo.ai/v2/chat \ -H "Authorization: Bearer $FELO_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/felo_query.json # Clean up rm -f /tmp/felo_query.json ``` ### Technical Analysis The skill always writes the request to the predictable path `/tmp/felo_query.json`. The shell redirection opens that path with truncation and does not request exclusive creation, verify ownership, or reject symbolic links. On systems where `/tmp` is shared, another local process can create the expected pathname before the skill runs. If the pathname is a symbolic link to a file writable by the victim, the redirection can follow the link and truncate or overwrite that target. The predictable name also creates a race between simultaneous skill executions: one invocation can replace or delete another invocation's request before `curl` reads it. The temporary file is created using the user's default permissions rather than explicitly restrictive permissions. Depending on the system `umask`, this may also expose the user's search query to other local users. ### Attack Path A local symlink-clobbering attack can proceed as follows: 1. The attacker monitors or anticipates use of the skill. 2. Before the skill creates its request, the attacker places `/tmp/felo_query.json` as a symbolic link to a file that the victim account can write. 3. The victim invokes the skill. 4. `cat > /tmp/felo_query.json` follows the symbolic link and truncates the linked target before writing the JSON request. 5. The target file is corrupted with the query data. Cleanup may fail in a sticky temporary directory if the victim does not own ...[truncated 873 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:88

Finding

User Query Is Inserted Into JSON Without Correct Serialization

Content

View full analysis

/tmp/felo_query.json << 'EOF' {"query": "USER_QUERY_HERE"} EOF # Call Felo API curl -s -X POST https://openapi.felo.ai/v2/chat \ -H "Authorization: Bearer $FELO_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/felo_query.json # Clean up rm -f /tmp/felo_query.json ``` The accompanying instruction states: ```text - Replace `USER_QUERY_HERE` with the actual user query - Use heredoc (`cat > file << 'EOF'`) to properly handle Chinese, Japanese, and special characters ``` ### Technical Analysis A quoted heredoc prevents shell expansion inside its body, but it does not perform JSON encoding. Literal replacement of `USER_QUERY_HERE` is unsafe when the query contains quotation marks, backslashes, newlines, control characters, or JSON structural tokens. For example, a query containing: ```text test", "additional_property": "attacker-controlled ``` can produce: ```json {"query": "test", "additional_property": "attacker-controlled"} ``` Other inputs can produce invalid JSON and cause request failure. Whether injected properties have a service-side effect depends on the Felo API parser and schema; the audited files do not demonstrate that the API accepts any specific additional property. Nevertheless, the local request-construction mechanism does not preserve the user's query as a single JSON string value. ### Attack Path 1. A user or upstream untrusted source supplies a query containing JSON metacharacters. 2. The agent follows the skill instruction and substitutes the query directly into the heredoc template. 3. The resulting document is malformed or has an altered JSON structure. 4. `curl` sends the modified document to the Felo endpoint. 5. The request either fails, carries a q ...[truncated 628 chars]

Remediation

View remediation

"$tmp_file" curl -sS -X POST https://openapi.felo.ai/v2/chat \ -H "Authorization: Bearer $FELO_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "@$tmp_file" ``` Alternatively, use Python's JSON library: ```bash QUERY="$USER_QUERY" python3 -c \ 'import json, os; print(json.dumps({"query": os.environ["QUERY"]}))' ``` The hardened implementation should: - Treat the query as data, never as JSON source text. - Correctly escape quotation marks, backslashes, Unicode, newlines, and control characters. - Validate that serialization succeeds before sending the request. - Check HTTP status and API error responses rather than assuming every response is valid. - Apply the same serialization method to all examples and execution instructions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

register) 2. Click your avatar (top right) → Settings 3. Navigate to API Keys tab 4. Click Create New Key 5. Copy your API key

Step 3: Configure

Set the FELO_API_KEY environment variable:

Linux/macOS:

bash

export FELO_API_KEY="your-api-key-here"

# Make it permanent (add to shell profile)
echo 'export FELO_API_KEY="your-api-key-here"' >> ~/.bashrc  # or ~/.zshrc

Windows (PowerShell):

powershell

$env:FELO_API_KEY="your-api-key-here"

# Make it permanent (system environment variables)
# System Properties → Advanced → Environment Variables → New

Windows (CMD):

cmd

set FELO_API_KEY=your-api-key-here

Verify: Check the variable is set:

bash

# Linux/macOS
echo $FELO_API_KEY

# Windows PowerShell
echo $env:FELO_API_KEY

You should see your API key.

Restart Claude Code to load the environment variable.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The auto-trigger conditions are very broad, including generic phrases like what is, how to, best, and location-oriented queries. In context, this means many ordinary prompts may be silently routed to an external search provider, increasing unintended data disclosure and over-invocation risk beyond what users may reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trigger word lists include extremely generic terms such as 'what,' 'where,' 'how,' and equivalents in multiple languages, making accidental activation very likely. In this skill's context, accidental activation means user prompts may be sent to an external API without a strong need, materially increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

-d @/tmp/felo_query.json

Clean up

rm -f /tmp/felo_query.json

text

**Notes:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

-d @/tmp/felo_query.json

Clean up

rm -f /tmp/felo_query.json

text

**Notes:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

-d @/tmp/felo_query.json

Clean up

rm -f /tmp/felo_query.json

text

**Notes:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

-d @/tmp/felo_query.json

Clean up

rm -f /tmp/felo_query.json

text

**Notes:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

-d @/tmp/felo_query.json

Clean up

rm -f /tmp/felo_query.json

text

**Notes:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description emphasizes real-time search and AI answers but does not plainly warn that user queries are transmitted to Felo, a third-party external service. This is dangerous because users may include sensitive terms, internal project context, or personal data in prompts without understanding the data-sharing boundary.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md

1. Visit [felo.ai](https://felo.ai) and log in (or register)
2. Click your avatar (top right) → **Settings**
3. Navigate to **API Keys** tab
4. Click **Create New Key**
5. Copy your API key

![API Key Location](https://felo.ai/assets/api-key-guide.png)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 400)May include surrounding context.

Solution:

bash

# Linux (Debian/Ubuntu)
sudo apt install curl

# macOS
brew install curl

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description directs use for broad categories like 'information queries,' 'how-to guides,' and 'any question where Claude's knowledge may be outdated,' which can cause the agent to invoke an external-search skill for routine prompts. This increases unnecessary data exposure to a third-party service and can bypass more appropriate local handling for benign user questions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

1. Visit [felo.ai](https://felo.ai) and log in (or register)
2. Click your avatar in the top right corner → Settings
3. Navigate to the "API Keys" tab
4. Click "Create New Key" to generate a new API Key
5. Copy and save your API Key securely

### 2. Configure API Key

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This command transmits the user's query to an external service along with an API credential, creating a real data egress path. While external calls are the purpose of the skill, the danger is that broadly triggered prompts may disclose sensitive user content to a third party without sufficient minimization or consent.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

EOF

# Call Felo API
curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer $FELO_API_KEY" \
  -H "Content-Type: application/json" \
  -d @/tmp/felo_query.json

Static analysis

No suspicious patterns detected.