Felo Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

The skill provides the advertised Felo web search function, but it can over-trigger on ordinary questions and send prompt text to a third-party API while using unsafe command examples for secrets and temporary files.

Review before installing. This skill sends search queries to Felo using your API key, and its broad auto-trigger rules may send more prompts than you expect. Avoid using it with secrets, private code, personal data, or confidential business context unless you explicitly intend that text to go to Felo. Prefer a pinned installer, avoid printing API keys, and replace the fixed /tmp JSON examples with safer request construction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: README.md:36
• Finding: Unpinned Package Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 36 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High ### Vulnerable Code ```bash npx @claude/skills add felo-search ``` ### Technical Analysis The documented installation procedure uses `npx` to resolve and execute `@claude/skills` without specifying an exact audited version or validating package integrity. Depending on the local npm configuration and cache state, `npx` can download the package from the configured registry and immediately execute its entry point. Because the package reference is mutable, the effective code executed by this command can differ from the code that was reviewed. Compromise of the package publisher, registry account, package release process, or configured registry could therefore turn the documented installation command into an arbitrary-code-execution channel. No evidence in the audited files establishes that the referenced package is currently malicious. The vulnerability is the unsafe, unpinned supply-chain execution pattern. ### Attack Path 1. An attacker compromises the `@claude/skills` package, its publisher account, or a registry used by the victim. 2. The attacker publishes a malicious version or redirects dependency resolution to hostile package contents. 3. A user follows the project documentation and runs `npx @claude/skills add felo-search`. 4. `npx` retrieves and executes the attacker-controlled package. 5. The malicious package runs with the operating-system privileges and environment access of the invoking user. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the installing user's account. The accessible scope can include project files, user-writable files, environment variables, developer credentials, and any services available to that account. This command does not itself request elevated privileges, so the direct privilege level is normally limited to that of the ...[truncated 22 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the installer to a specific reviewed version, for example `npx @claude/skills@<audited-version> ...`. - Publish and verify package integrity information, signatures, or trusted provenance before execution. - Use a lockfile and an approved registry where the installation workflow supports them. - Avoid automatic execution of newly downloaded packages. Prefer downloading, inspecting, and then running a verified artifact. - Document the expected package publisher, version, checksum, and verification procedure. - In automated environments, configure npm to reject unexpected registries and prevent lifecycle scripts unless they are explicitly required and reviewed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:82
• Finding: API Key Exposed Through Terminal Output<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 82-86 **Vulnerability Type**: Plaintext credential disclosure **Risk Level**: Medium ### Vulnerable Code ```bash # Linux/macOS echo $FELO_API_KEY # Windows PowerShell echo $env:FELO_API_KEY ``` ### Technical Analysis The documented verification procedure prints the complete `FELO_API_KEY` bearer credential to standard output. Verifying configuration does not require revealing the credential value. Terminal output may be retained or observed through CI logs, command transcripts, screen sharing, terminal recording, support screenshots, remote-session monitoring, or copied diagnostic output. Because the key is used as a bearer token, any party that obtains it may be able to authenticate to the Felo API as the affected user until the key expires or is revoked. ### Attack Path 1. A user configures `FELO_API_KEY` and follows the documented verification instructions. 2. The complete secret is printed to the terminal. 3. The output is captured by logs, recording software, screen sharing, screenshots, or another observer with access to the session. 4. The observer copies the exposed token. 5. The observer submits API requests using `Authorization: Bearer <stolen-key>`. ### Impact Assessment Exploitation exposes the Felo API credential rather than granting direct operating-system privileges. An attacker may consume the victim's API quota, issue requests under the victim's account, incur usage charges where applicable, or access any API capabilities authorized to that key. The exact service-side scope depends on the permissions assigned by Felo. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Replace plaintext output with a presence check that does not reveal the value: ```bash if [ -n "${FELO_API_KEY:-}" ]; then echo "FELO_API_KEY is configured" else echo "FELO_API_KEY is not configured" fi ``` For PowerShell: ```powershell if ($env:FELO_API_KEY) { Write-Output "FELO_API_KEY is configured" } else { Write-Output "FELO_API_KEY is not configured" } ``` Additional hardening measures: - If identification is necessary, reveal only a short masked suffix. - Mark the key as a secret in CI systems so accidental output is redacted. - Warn users not to place terminal output containing secrets in bug reports or screenshots. - Rotate any key that has already been exposed through logs or shared terminal output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:89
• Finding: Predictable Shared Temporary File Allows Symlink Clobbering and Data Collisions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 89-100; repeated at lines 147-156, 174-183, 192-201, and 210-219 **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash cat > /tmp/felo_query.json << 'EOF' {"query": "USER_QUERY_HERE"} EOF # Call Felo API curl -s -X POST https://openapi.felo.ai/v2/chat \ -H "Authorization: Bearer $FELO_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/felo_query.json # Clean up rm -f /tmp/felo_query.json ``` ### Technical Analysis The skill always writes the request to the predictable path `/tmp/felo_query.json`. The shell redirection opens that path with truncation and does not request exclusive creation, verify ownership, or reject symbolic links. On systems where `/tmp` is shared, another local process can create the expected pathname before the skill runs. If the pathname is a symbolic link to a file writable by the victim, the redirection can follow the link and truncate or overwrite that target. The predictable name also creates a race between simultaneous skill executions: one invocation can replace or delete another invocation's request before `curl` reads it. The temporary file is created using the user's default permissions rather than explicitly restrictive permissions. Depending on the system `umask`, this may also expose the user's search query to other local users. ### Attack Path A local symlink-clobbering attack can proceed as follows: 1. The attacker monitors or anticipates use of the skill. 2. Before the skill creates its request, the attacker places `/tmp/felo_query.json` as a symbolic link to a file that the victim account can write. 3. The victim invokes the skill. 4. `cat > /tmp/felo_query.json` follows the symbolic link and truncates the linked target before writing the JSON request. 5. The target file is corrupted with the query data. Cleanup may fail in a sticky temporary directory if the victim does not own ...[truncated 873 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create a unique private temporary file and guarantee cleanup: ```bash tmp_file="$(mktemp "${TMPDIR:-/tmp}/felo_query.XXXXXX")" || exit 1 trap 'rm -f -- "$tmp_file"' EXIT chmod 600 "$tmp_file" # Safely generate request JSON here. curl -sS -X POST https://openapi.felo.ai/v2/chat \ -H "Authorization: Bearer $FELO_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "@$tmp_file" ``` Further hardening should include: - Set a restrictive `umask`, such as `umask 077`, before creating sensitive temporary data. - Never use a constant filename in a shared temporary directory. - Quote every temporary pathname. - Use a cleanup trap so abnormal exits do not leave query data behind. - Where possible, generate the JSON in memory and pipe it directly to `curl`, eliminating the temporary file. - Apply the correction to every repeated example in `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:88
• Finding: User Query Is Inserted Into JSON Without Correct Serialization<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 88-105 **Vulnerability Type**: JSON injection and malformed request construction **Risk Level**: Medium ### Vulnerable Code ```bash # Create query JSON (replace USER_QUERY with actual query) cat > /tmp/felo_query.json << 'EOF' {"query": "USER_QUERY_HERE"} EOF # Call Felo API curl -s -X POST https://openapi.felo.ai/v2/chat \ -H "Authorization: Bearer $FELO_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/felo_query.json # Clean up rm -f /tmp/felo_query.json ``` The accompanying instruction states: ```text - Replace `USER_QUERY_HERE` with the actual user query - Use heredoc (`cat > file << 'EOF'`) to properly handle Chinese, Japanese, and special characters ``` ### Technical Analysis A quoted heredoc prevents shell expansion inside its body, but it does not perform JSON encoding. Literal replacement of `USER_QUERY_HERE` is unsafe when the query contains quotation marks, backslashes, newlines, control characters, or JSON structural tokens. For example, a query containing: ```text test", "additional_property": "attacker-controlled ``` can produce: ```json {"query": "test", "additional_property": "attacker-controlled"} ``` Other inputs can produce invalid JSON and cause request failure. Whether injected properties have a service-side effect depends on the Felo API parser and schema; the audited files do not demonstrate that the API accepts any specific additional property. Nevertheless, the local request-construction mechanism does not preserve the user's query as a single JSON string value. ### Attack Path 1. A user or upstream untrusted source supplies a query containing JSON metacharacters. 2. The agent follows the skill instruction and substitutes the query directly into the heredoc template. 3. The resulting document is malformed or has an altered JSON structure. 4. `curl` sends the modified document to the Felo endpoint. 5. The request either fails, carries a q ...[truncated 628 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use a JSON-aware serializer rather than textual substitution. For example: ```bash tmp_file="$(mktemp "${TMPDIR:-/tmp}/felo_query.XXXXXX")" || exit 1 trap 'rm -f -- "$tmp_file"' EXIT chmod 600 "$tmp_file" jq -n --arg query "$USER_QUERY" '{query: $query}' > "$tmp_file" curl -sS -X POST https://openapi.felo.ai/v2/chat \ -H "Authorization: Bearer $FELO_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "@$tmp_file" ``` Alternatively, use Python's JSON library: ```bash QUERY="$USER_QUERY" python3 -c \ 'import json, os; print(json.dumps({"query": os.environ["QUERY"]}))' ``` The hardened implementation should: - Treat the query as data, never as JSON source text. - Correctly escape quotation marks, backslashes, Unicode, newlines, and control characters. - Validate that serialization succeeds before sending the request. - Check HTTP status and API error responses rather than assuming every response is valid. - Apply the same serialization method to all examples and execution instructions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

register)
2. Click your avatar (top right) → **Settings**
3. Navigate to **API Keys** tab
4. Click **Create New Key**
5. Copy your API key

![API Key Location](https://felo.ai/assets/api-key-guide.png)

### Step 3: Configure

Set the `FELO_API_KEY` environment variable:

**Linux/macOS:**
```bash
export FELO_API_KEY="your-api-key-here"

# Make it permanent (add to shell profile)
echo 'export FELO_API_KEY="your-api-key-here"' >> ~/.bashrc  # or ~/.zshrc
```

**Windows (PowerShell):**
```powershell
$env:FELO_API_KEY="your-api-key-here"

# Make it permanent (system environment variables)
# System Properties → Advanced → Environment Variables → New
```

**Windows (CMD):**
```cmd
set FELO_API_KEY=your-api-key-here
```

**Verify:** Check the variable is set:
```bash
# Linux/macOS
echo $FELO_API_KEY

# Windows PowerShell
echo $env:FELO_API_KEY
```

You should see your API key.

**Restart Claude Code** to load the environment variable.

###

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The auto-trigger conditions are very broad, including generic phrases like `what is`, `how to`, `best`, and location-oriented queries. In context, this means many ordinary prompts may be silently routed to an external search provider, increasing unintended data disclosure and over-invocation risk beyond what users may reasonably expect.

Vague Triggers

High

• Confidence: 99% confidence
• Finding: The trigger word lists include extremely generic terms such as 'what,' 'where,' 'how,' and equivalents in multiple languages, making accidental activation very likely. In this skill's context, accidental activation means user prompts may be sent to an external API without a strong need, materially increasing privacy and data-handling risk.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-d @/tmp/felo_query.json

# Clean up
rm -f /tmp/felo_query.json
```

**Notes:**

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-d @/tmp/felo_query.json

# Clean up
rm -f /tmp/felo_query.json
```

**Notes:**

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-d @/tmp/felo_query.json

# Clean up
rm -f /tmp/felo_query.json
```

**Notes:**

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-d @/tmp/felo_query.json

# Clean up
rm -f /tmp/felo_query.json
```

**Notes:**

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-d @/tmp/felo_query.json

# Clean up
rm -f /tmp/felo_query.json
```

**Notes:**

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The description emphasizes real-time search and AI answers but does not plainly warn that user queries are transmitted to Felo, a third-party external service. This is dangerous because users may include sensitive terms, internal project context, or personal data in prompts without understanding the data-sharing boundary.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. Visit [felo.ai](https://felo.ai) and log in (or register)
2. Click your avatar (top right) → **Settings**
3. Navigate to **API Keys** tab
4. Click **Create New Key**
5. Copy your API key

![API Key Location](https://felo.ai/assets/api-key-guide.png)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Solution:**
```bash
# Linux (Debian/Ubuntu)
sudo apt install curl

# macOS
brew install curl

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill description directs use for broad categories like 'information queries,' 'how-to guides,' and 'any question where Claude's knowledge may be outdated,' which can cause the agent to invoke an external-search skill for routine prompts. This increases unnecessary data exposure to a third-party service and can bypass more appropriate local handling for benign user questions.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. Visit [felo.ai](https://felo.ai) and log in (or register)
2. Click your avatar in the top right corner → Settings
3. Navigate to the "API Keys" tab
4. Click "Create New Key" to generate a new API Key
5. Copy and save your API Key securely

### 2. Configure API Key

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

EOF

# Call Felo API
curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer $FELO_API_KEY" \
  -H "Content-Type: application/json" \
  -d @/tmp/felo_query.json

• Confidence: 95% confidence
• Finding: This command transmits the user's query to an external service along with an API credential, creating a real data egress path. While external calls are the purpose of the skill, the danger is that broadly triggered prompts may disclose sensitive user content to a third party without sufficient minimization or consent.

Static analysis

No suspicious patterns detected.