LogEase Search

• Outcome: Review
• Latest audit: May 28, 2026 · 2:31 PM UTC
• Version: 1.1.0

Overview

This LogEase search skill exposes sensitive administrator access and bundles broader platform-control tools than a search-only skill needs.

Install only in an authorized internal environment after removing and rotating the published admin password, replacing it with least-privilege runtime credentials, enforcing HTTPS with certificate validation, and restricting the tool surface to read-only LogEase search unless an administrator explicitly approves mutating actions. Treat returned logs as sensitive data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (59)

Tainted flow: 'LOGEASE_URL' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

}
    
    try:
        r = requests.get(
            LOGEASE_URL + '/api/v3/search/sheets/',
            params=params,
            auth=HTTPBasicAuth(LOGEASE_USERNAME, LOGEASE_PASSWORD),

• Confidence: 98% confidence
• Finding: The request URL is sourced from an environment variable and combined with Basic Auth credentials, so if LOGEASE_URL is changed to an attacker-controlled host the script will send the username, password, and query data to that destination. This is especially dangerous because the default scheme is plain HTTP, which also exposes credentials to interception in transit.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This OpenAPI schema exposes an extremely broad set of high-risk administrative operations, including account enable/disable, password changes, API key creation, permission management, resource deletion, and system-wide configuration changes. In the context of an agent skill with no narrowing metadata or purpose constraints, this dramatically increases the blast radius of prompt injection, tool misuse, or overprivileged invocation into full platform compromise.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The schema includes remote agent management features such as configuration creation/update, status control, restart/stop commands, direct agent communication, and config upload. Exposing remote execution-adjacent and infrastructure control primitives to an unspecified skill creates a path to service disruption, malicious reconfiguration, lateral movement, or deployment of hostile collection behavior if the agent is tricked or abused.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The schema exposes infrastructure and secret-bearing configuration APIs for databases, LDAP, storage backends, remote clusters, and related connectivity settings, including fields for passwords, secret keys, JDBC URLs, and connection parameters. In an agent skill, these operations can enable credential exposure, unauthorized infrastructure changes, persistence, data exfiltration, or trust-boundary expansion far beyond normal task execution.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The schema permits upload/download of scripts, plugins, templates, agent files, and configuration artifacts, including creation and update flows for executable or operational content. In the absence of strong purpose limitation, these capabilities can be abused to introduce malicious code, alter processing logic, exfiltrate files, or weaponize the platform through agent-mediated deployment.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The constructor creates an HTTPS agent with rejectUnauthorized set to false whenever no custom agent is supplied, which disables TLS certificate validation for all HTTPS requests by default. This enables man-in-the-middle attacks, allowing an attacker on the network or controlling DNS/proxy paths to intercept or modify API traffic, including credentials and returned data.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The tool is described as generating API-calling code, but it directly executes the HTTP request. This discrepancy is security-relevant because users or downstream agents may believe they are performing a dry-run/codegen step when they are actually triggering state-changing authenticated actions against the remote LogEase server.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill exposes a generic authenticated API execution primitive driven by user-supplied path, method, and parameters. Because the available operations are sourced from an OpenAPI spec and executed with environment-provided credentials, an attacker or prompt injection could invoke sensitive read/write administrative endpoints on the backend service without granular authorization controls in the skill itself.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill loads credentials from environment variables and uses them to make authenticated outbound requests to a remote LogEase server, even though the provided skill context does not describe a need for external authenticated API access. In an MCP tool server, exposing such capabilities through tool calls can expand the attack surface and enable unintended access to internal or sensitive services if the OpenAPI spec includes privileged operations.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code allows TLS certificate validation to be disabled via LOGEASE_TLS_REJECT_UNAUTHORIZED=false, which permits HTTPS connections without verifying the server's identity. This enables man-in-the-middle interception or modification of authenticated API traffic, including Authorization headers and API responses, especially dangerous if the service is reached over untrusted or internal networks.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill reads authentication material from environment variables and configures an HTTP client to make authenticated outbound requests to a remote LogEase server. In an agent skill, this creates a real data-boundary and capability-expansion risk because the model can invoke networked operations with ambient credentials, even though the file provides no user disclosure, approval gate, or operation-level restriction.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The server dynamically exposes tools generated from an OpenAPI spec and forwards tool calls directly through the converter without visible filtering or scope limitation. That means any operation defined in the spec may become callable by the agent, potentially including sensitive read/write/admin actions, greatly increasing the blast radius if the model is prompted into unsafe behavior.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script contains hardcoded Basic Auth credentials and uses them to query an internal log service over HTTP, giving anyone with file access immediate authenticated access to potentially sensitive audit data. In the context of an agent skill, this is especially dangerous because the capability is embedded directly in code and can be reused or modified to access internal systems without any approval boundary, while the use of plain HTTP also risks credential exposure in transit.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The script’s stated purpose is attack analysis, but it contains hardcoded admin credentials and directly authenticates to an internal log/SIP platform. Embedding privileged credentials in code is a real security issue because anyone with access to the skill can reuse them to query sensitive internal data or pivot further into the environment.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The script’s stated purpose is reporting on internet attacks, but it embeds administrator Basic Auth credentials and uses them to access an internal log platform at a private IP over plain HTTP. This creates a real secret-exposure issue and unauthorized-reuse risk, especially because anyone with the script can recover and use the credentials against the internal service.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The module description claims the script only parses attack sources from raw_message, but the code also connects to an internal service and uses hardcoded Basic Auth credentials to retrieve data. This mismatch hides sensitive behavior from reviewers and users, increasing the risk of unauthorized internal data access and credential exposure.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds administrative Basic Auth credentials and uses them to query an internal log/search platform over HTTP. This creates a direct secret-exposure risk and enables anyone with code access to retrieve potentially sensitive security telemetry, making unauthorized access and data disclosure likely if the script is copied, leaked, or reused.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds a privileged Basic Auth credential and uses it to query an internal log platform over HTTP, enabling anyone with access to the file to reuse those credentials for authenticated access. This is especially dangerous because the account appears administrative and the script accesses sensitive security telemetry, creating both credential exposure and unauthorized data-access risk.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The script advertises itself as a generic log search helper, yet embeds a fixed administrator username and password and automatically uses them for every request. This is dangerous because anyone with access to the script can recover the credentials, reuse them outside the tool, and gain privileged access to the logging platform.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The tool authenticates as an admin account even though its stated function is only to perform searches, which likely does not require full administrative privileges. Using unnecessary elevated privileges increases blast radius: compromise of the script, host, or network path can yield full platform access rather than limited read-only search access.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The script contains embedded default service credentials, including a hardcoded password, for an external log system. Shipping usable credentials in code can expose unauthorized access to logs and encourages insecure credential reuse across deployments.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script contains hardcoded credentials and automatically performs authenticated requests to an internal log platform at a private IP address. Even if the purpose is reporting, embedding privileged access in code without documented justification or access controls creates a real security issue because anyone with the script can reuse the credentials to query internal security telemetry.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill embeds a reachable internal service endpoint together with plaintext administrator BasicAuth credentials. Anyone with access to the skill file can reuse these secrets to query sensitive logs, pivot into internal systems, or abuse the logging platform; using HTTP rather than HTTPS further increases exposure because credentials may be transmitted in cleartext on the network.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill instructs users to search security alerts, network device logs, and system logs without warning that results may contain sensitive operational, personal, or security-relevant data. This increases the risk of over-collection, inappropriate disclosure, and unsafe handling of high-sensitivity log contents during normal use.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: This endpoint overloads create, update, and delete semantics into a single PUT operation based on whether id and input are present. Such ambiguous behavior increases the risk that an agent or client will perform an unintended destructive action, especially in automated workflows, leading to accidental deletion or modification of collection inputs on managed agents.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: rizhiyi-mcp/dist/custom_tools_server.js:10

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: rizhiyi-mcp/dist/openapi_server.js:11

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: rizhiyi-mcp/src/custom_tools_server.ts:15

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: rizhiyi-mcp/src/openapi_server.ts:16

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: rizhiyi-mcp/dist/custom_tools_server.js:19

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: rizhiyi-mcp/dist/openapi_server.js:20

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: rizhiyi-mcp/src/custom_tools_server.ts:26

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: rizhiyi-mcp/src/openapi_server.ts:27

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: rizhiyi-mcp/dist/client.js:9

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: rizhiyi-mcp/src/client.ts:12