Security audit

ic-search

Security checks for vulnerabilities and agentic risk

Overview

This electronics search skill has a coherent purpose, but it sends user search terms and a fixed token to an external service over plaintext HTTP with broad auto-trigger rules.

Review before installing. Use this only if you are comfortable sending component part numbers, quantities, brands, and sourcing intent to the documented third-party API, and avoid confidential BOMs or procurement plans unless the publisher moves the service to HTTPS and narrows when the skill auto-invokes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/test_api.py:25
Finding: API Credentials and User Queries Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/test_api.py:14
Finding: Shared API Authentication Token Hard-Coded in Source and Documentation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill sends search queries over plain HTTP to an external host and does not warn users that their queries leave the system unencrypted. This exposes potentially sensitive procurement data, part numbers, quantities, and sourcing intent to interception or tampering by attackers on the network path.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger condition includes any mention of "PCS 单位," which is a very common token in electronics, inventory, purchasing, and even unrelated tabular text. This can cause the skill to activate unexpectedly and send user-provided content to the external API without clear user intent, increasing the risk of unintended data disclosure and workflow hijacking.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation rules are broad and ambiguous, relying on generic terms like "询价", "求购", "找现货", and free-form model text without clear boundaries or confirmation. In a chat environment, this can misfire on conversational mentions and route unintended user text to the remote service, creating privacy and integrity risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation directs use of an HTTP GET endpoint with sensitive query content and a fixed authentication token in the URL, but does not warn that both the search terms and token will be transmitted in plaintext and may be exposed via network interception, proxy logs, browser history, and server access logs. In a skill context, this is more dangerous because agents may automatically send user-supplied procurement or inventory queries, potentially leaking business-sensitive information at scale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file repeatedly instructs the skill to return fixed Chinese phrases directly to the user, such as "您无权操作". Because the file does not offer user opt-in or explain that the skill is intentionally limited to a Chinese-language context, it creates a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. This file presents the skill entirely in Chinese and all example user inputs are Chinese, with no indication that the skill supports other languages, that Chinese is optional, or that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends user-provided search terms to an external endpoint over plain HTTP, which exposes the request path and query string to interception or modification by anyone on the network path. Because the search term is included directly in the URL, potentially sensitive user queries can be observed in transit, logged by intermediaries, or altered via man-in-the-middle attacks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language instructions and user-facing response guidance in this file are entirely in Chinese, but the document does not indicate that the skill is region-specific or provide an opt-in language choice. Under the stated policy, forcing a specific language without user choice or justification is a policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This is a markdown file, so SQP-2 applies to missing user-facing warnings about behaviors affecting privacy or data handling. The examples repeatedly state that the skill will call an API and send the user's query content in the msg field, but there is no warning that entered part numbers, brands, or search terms are transmitted to an external service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: Natural-language strings, comments, and user-facing output in this file are exclusively Chinese, with no indication that the skill is region-specific or that another language is available. Under the policy, forcing a language or locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.