Aliyun Web Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:13 PM UTC
• Version: 1.0.0

Overview

This Aliyun search skill has a coherent purpose, but its documentation and script can send API keys and search queries over unsafe or unvalidated endpoints.

Review this skill before installing. Use only HTTPS Aliyun endpoints, replace the sample key with your own credential, avoid sending sensitive prompts or conversation history through the search service, and do not use it in an environment where untrusted users can modify ALIYUN_SEARCH_HOST. The observed issues support caution, not a finding of intentional malware.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:109

Finding

Bearer API Key Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:109-111, 152-153, 193, 201; scripts/search.sh:26, 39-43
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: High

Vulnerable Code

SKILL.md:109-111:

markdown

| North China 2-Beijing (华北 2-北京) | `http://default-21rb.platform-cn-beijing.opensearch.aliyuncs.com` |
| East China 1-Hangzhou (华东 1-杭州) | `http://default-21rb.platform-cn-hangzhou.opensearch.aliyuncs.com` |
| South China 1-Shenzhen (华南 1-深圳) | `http://default-21rb.platform-cn-shenzhen.opensearch.aliyuncs.com` |

scripts/search.sh:26, 39-43:

bash

URL="${BASE_URL}/v3/openapi/workspaces/${WORKSPACE}/web-search/${SERVICE_ID}"

# Make request
curl -s -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$BODY"

Technical Analysis

The documented service addresses use the unencrypted http:// scheme. The script directly appends the API path to the configured address and transmits ALIYUN_SEARCH_API_KEY in an HTTP Authorization: Bearer header.

HTTP does not provide transport confidentiality, server authentication, or integrity protection. An actor capable of monitoring or modifying the network path can read the API key and query contents or alter the request and response. The script does not reject plaintext URLs or require successful TLS verification.

Attack Path

1. A user follows the supplied documentation and configures an http:// Aliyun service address.
2. The user invokes scripts/search.sh with a search query.
3. The script places the API key in the bearer authorization header.
4. curl transmits the header, query, and response over plaintext HTTP.
5. A network-positioned attacker captures the request and extracts the API key.
6. The attacker reuses the captured key against the associated service until it is revoked or expires.

Impact Assessment

A successful ...[truncated 318 chars]

Remediation

View remediation

Remediation Suggestions

• Replace every documented http:// endpoint with the provider's verified https:// endpoint.
• Parse ALIYUN_SEARCH_HOST and reject any scheme other than HTTPS.
• Fail closed when TLS certificate or hostname validation fails.
• Consider enforcing an allowlist of approved Aliyun service domains.
• Disable redirects or ensure credentials cannot be forwarded to a different origin.
• Update all PowerShell, Bash, and JSON configuration examples consistently.
• Rotate any API key that may previously have been transmitted over an untrusted plaintext connection.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search.sh:8

Finding

API Key Can Be Exfiltrated to an Arbitrary Configured Host

Content

View full analysis

Vulnerability Details

File Location: scripts/search.sh:8, 15-17, 26, 39-43
Vulnerability Type: Unrestricted credential destination
Risk Level: High

Vulnerable Code

bash

BASE_URL="${ALIYUN_SEARCH_HOST:-}"

if [ -z "$BASE_URL" ]; then
  echo "Error: ALIYUN_SEARCH_HOST environment variable is not set"
  exit 1
fi

URL="${BASE_URL}/v3/openapi/workspaces/${WORKSPACE}/web-search/${SERVICE_ID}"

# Make request
curl -s -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$BODY"

Technical Analysis

The destination is taken entirely from the ALIYUN_SEARCH_HOST environment variable. The only validation checks whether it is empty. There is no verification of the scheme, hostname, port, or ownership of the destination.

Consequently, the script sends the bearer credential to any URL selected through the environment. An attacker who can influence the process environment, Skill configuration, deployment template, or copied setup instructions can redirect the request to an attacker-controlled server. The invocation still appears to be a normal web-search operation.

Attack Path

1. The attacker gains the ability to modify ALIYUN_SEARCH_HOST, such as through a poisoned configuration, deployment environment, or setup instruction.
2. The attacker sets it to an endpoint under their control, for example https://attacker.example.
3. The user invokes the Skill normally.
4. The script builds a URL beneath the attacker-controlled origin.
5. curl sends both the bearer API key and search query to that server.
6. The attacker records the authorization header and reuses the credential against the legitimate service.

Impact Assessment

This flaw exposes the complete API key and submitted search data. An attacker can perform any API operation authorized by the key, consume service quota, incur associated costs, and access capabilities ...[truncated 145 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the configured URL rather than accepting it as an opaque string.
• Require an https scheme.
• Restrict the hostname to explicitly approved Aliyun domains or, preferably, a deployment-specific allowlist.
• Reject embedded credentials, unexpected ports, malformed hosts, fragments, and ambiguous URL forms.
• Prevent cross-origin credential forwarding by disabling redirects with --max-redirs 0, unless redirects are strictly validated.
• Separate endpoint selection from secret attachment so authorization headers are only added after destination validation.
• Protect the Skill configuration and environment from modification by untrusted users.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:148

Finding

API-Key-Like Credential Published in Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:148-155
Vulnerability Type: Hardcoded credential-like value
Risk Level: Medium

Vulnerable Code

markdown

**Example (Beijing Region) | 示例（北京地区）**：
```json
{
  "env": {
    "ALIYUN_SEARCH_API_KEY": "OS-0fw5937ch3u5eegd",
    "ALIYUN_SEARCH_HOST": "http://default-21rb.platform-cn-beijing.opensearch.aliyuncs.com"
  }
}

text

### Technical Analysis

The documentation contains a concrete value matching the documented Aliyun API-key format rather than an unmistakable placeholder. Static inspection cannot establish whether the value is active, expired, fabricated, or revoked. Nevertheless, publishing a credential-like value creates a potential secret-exposure condition and may cause users to copy an unintended credential into their configuration.

If the value was ever valid, removal from the current file alone would not be sufficient because it may remain in repository history, package archives, caches, or mirrors.

### Attack Path

1. An attacker reads the publicly distributed Skill documentation.
2. The attacker extracts `OS-0fw5937ch3u5eegd`.
3. The attacker tests it against the documented Aliyun service.
4. If the value is active, the attacker performs requests using the credential's assigned permissions and quota.

### Impact Assessment

If valid, the exposed value could allow unauthorized API requests, quota consumption, and possible financial or operational impact within the permissions of the key. No evidence from the audited files confirms that the key is currently active, so the realized impact depends on its validity and assigned permissions.

Remediation

View remediation

Remediation Suggestions

• Replace the value with an unmistakable placeholder such as OS-REPLACE_WITH_YOUR_KEY.
• Determine whether the published value was ever a real credential.
• If it was real or its status is uncertain, revoke and rotate it immediately.
• Search version-control history, releases, package archives, logs, and mirrors for the same value.
• Enable automated secret scanning in pre-commit and continuous-integration workflows.
• Ensure all examples consistently use nonfunctional placeholder values.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.sh:20

Finding

Unescaped User Input Permits JSON Request-Body Injection

Content

View full analysis

Vulnerability Details

File Location: scripts/search.sh:20-35
Vulnerability Type: JSON injection and insufficient input validation
Risk Level: Medium

Vulnerable Code

bash

QUERY="${1:-AI news}"
TOP_K="${2:-5}"

WORKSPACE="default"
SERVICE_ID="ops-web-search-001"

URL="${BASE_URL}/v3/openapi/workspaces/${WORKSPACE}/web-search/${SERVICE_ID}"

# Build JSON body
BODY=$(cat <<EOF
{
  "query": "$QUERY",
  "query_rewrite": true,
  "top_k": $TOP_K,
  "content_type": "snippet"
}
EOF
)

Technical Analysis

QUERY is interpolated directly into a JSON string without escaping quotation marks, backslashes, control characters, or newlines. TOP_K is inserted directly as an unquoted JSON value without checking that it is an integer in the documented range of 1 through 10.

A crafted query can terminate the original JSON string and introduce additional properties. A crafted TOP_K can similarly insert arbitrary JSON syntax. Depending on how the remote API handles duplicate properties and unknown fields, an attacker may override request options or trigger malformed-request behavior.

This is request-body JSON injection, not shell-command injection: shell metacharacters contained in the variables are expanded as data inside the here-document and are not re-evaluated as shell commands.

Attack Path

1. An attacker controls or influences the query or top_k arguments passed to the script.
2. The attacker supplies characters that terminate the intended JSON value and inject additional JSON structure.
3. The here-document constructs a body whose syntax or semantic fields differ from those intended by the script.
4. curl sends the altered body to the remote API.
5. The backend either processes injected properties, applies unexpected options, or rejects the malformed request, potentially disrupting service.

Impact Assessment

Exploitation can manipulate outbound API request s ...[truncated 326 chars]

Remediation

View remediation

Remediation Suggestions

• Construct JSON with a proper serializer instead of string interpolation.

• With jq, use --arg for the query and a validated numeric value for top_k, for example:

  bash

  case "$TOP_K" in
    ''|*[!0-9]*)
      echo "Error: top_k must be an integer from 1 to 10" >&2
      exit 1
      ;;
  esac
  
  if [ "$TOP_K" -lt 1 ] || [ "$TOP_K" -gt 10 ]; then
    echo "Error: top_k must be an integer from 1 to 10" >&2
    exit 1
  fi
  
  BODY=$(jq -n \
    --arg query "$QUERY" \
    --argjson top_k "$TOP_K" \
    '{
      query: $query,
      query_rewrite: true,
      top_k: $top_k,
      content_type: "snippet"
    }')
  

• Reject invalid or excessively long queries before sending them.

• Check serializer and curl exit statuses and fail clearly when body construction or transmission fails.

• Add tests containing quotation marks, backslashes, newlines, Unicode characters, and attempted property injection.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation includes shell-capable usage examples and references executable scripts, but it does not declare any tool scope such as permissions or allowed-tools. This can cause the host or user to underestimate that the skill may invoke local shell execution, increasing the risk of unexpected command execution or over-broad agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that it supports conversation history and external real-time search, but it does not clearly warn that user queries and possibly conversation context may be sent to Aliyun's external service. This creates a privacy and data-handling risk because users may unknowingly disclose sensitive prompts, internal data, or regulated information to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example configuration shows what appears to be a realistic API key value rather than an obviously fake placeholder. Even if illustrative, publishing credential-like strings can lead to accidental leakage of real secrets, copy-paste misuse, or normalization of insecure documentation practices around credential handling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.sh (reported line 40)May include surrounding context.

sh

)

# Make request
curl -s -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$BODY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This shell script performs an HTTP POST to an external Aliyun endpoint and includes both the user-supplied query and a bearer token. While the code has internal comments and missing-env error messages, it does not visibly disclose to the user at execution time that their query will be transmitted to a remote service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The natural-language description frames the skill as returning Chinese results by default, which can be interpreted as a locale preference baked into the skill behavior. Although advanced configuration later mentions a default language setting, the top-level description does not clearly indicate that users can choose English or another locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest uses a bilingual description at L4 and includes a chinese tag at L7, which suggests a language/locale preference but does not explain whether the skill is limited to Chinese users or whether other language options are available. Because policy violations here are limited to natural-language signals, this is a low-severity documentation concern rather than proof of enforced behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.