Security audit

爱奇艺影视搜索

Security checks for vulnerabilities and agentic risk

Overview

This iQIYI search skill does what it says, but its documented script has a real unsafe code-execution path that users should review before installing.

Review before installing. The skill is not showing deception or data theft, but do not run the documented search.sh on sensitive systems until it is fixed to pass HTML and keywords as data rather than interpolating them into Python source. Prefer a pinned, local agent-browser dependency and add a clear notice that search terms are sent to iQIYI.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/search.sh:49
Finding: Arbitrary Python Code Execution Through Unquoted Heredoc Interpolation
Content: View full analysis
Remediation: View remediation
"$TEMP_FILE" python3 parse_iqiyi.py "$TEMP_FILE" "$KEYWORD" ``` Alternatively, pass structured data through standard input and decode it using `json.load(sys.stdin)`. Quoting the heredoc delimiter alone is insufficient if variable interpolation is still required; the fundamental fix is to stop embedding untrusted values in executable Python source. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:50
Finding: Unpinned Global Installation of a Third-Party Browser Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill invokes a local shell script and explicitly depends on a browser automation binary, which implies network access and local file/script execution capability, yet the manifest declares no explicit tool scope or permissions. This weakens least-privilege controls and can allow broader-than-expected access if the skill is auto-approved or composed with other agent capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation description includes a broad trigger phrase like asking what is available on iQIYI, which can cause the skill to activate for loosely related user requests. Overbroad routing increases the chance of unintended browser/network actions and can expose user queries to an external site when the user did not clearly request that behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends the raw user search term to iqiyi.com by constructing a remote search URL and opening it in a browser context, without any notice, consent, or data-minimization controls. This can expose potentially sensitive user interests or identifiers to a third party, and the skill context makes this real because external search transmission is the core behavior of the tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script's comments and runtime error/output strings are entirely in Chinese, including usage guidance and error messages. There is no indication that the skill is intentionally region-specific or that users may choose another language, which can violate a language/locale policy requiring opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill metadata and user-facing documentation are entirely in Chinese, indicating a language-specific interaction model, but the file does not state that Chinese is optional or that the skill is intended only for Chinese-speaking users. Under the language/locale policy, a fixed language should be justified or offered as a user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comments and command-line messages are entirely in Chinese, and the script does not offer any language selection or explain that it is intentionally limited to a Chinese-speaking audience. That creates a natural-language locale policy issue under the requirement to avoid forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script sends the user's search keyword to an external website by constructing a search URL and opening it in agent-browser. While there is a status message on L21, it does not warn that the query will be transmitted to a third-party service, and there is no other user disclosure in comments or documentation shown here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.