Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Zhipu web-search helper that sends user search requests to the declared Zhipu API, with privacy cautions around queries and optional user IDs.
Install only if you are comfortable sending search queries to Zhipu/BigModel. Do not include secrets, private internal text, or personal data in search queries, and omit user_id or use a pseudonymous value unless you specifically need it.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"Content-Type": "application/json",
}
response = requests.post(
f"{API_BASE_URL}/chat/completions",
headers=headers,
json=payload,
The skill requires an API key from the environment and is explicitly designed to perform web searches, which implies network access, but it does not declare any tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the skill harder to sandbox or review, increasing the risk of unintended outbound access or misuse if the skill is invoked in a broader agent environment.
The skill documentation instructs users to provide a user_id and indicates it is an end-user identifier, but it does not include a privacy notice, purpose limitation, retention guidance, or warning that this identifier may be transmitted to a third-party search provider. In a web-search skill, this is more dangerous because user queries and identifiers can be linked externally, creating privacy, compliance, and tracking risks.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"Content-Type": "application/json",
}
response = requests.post(
f"{API_BASE_URL}/chat/completions",
headers=headers,
json=payload,
The script sends the user-provided search query and optional user_id to an external third-party service, but the code provides no consent prompt, warning, redaction, or validation around what may be transmitted. In an agent-skill context, this can unintentionally disclose sensitive prompts, identifiers, or internal data if upstream callers pass secrets or personal data into the query or user_id fields.
No suspicious patterns detected.