Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `metaso-api.js` - API 核心模块
Security audit
Metaso Search V2
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward Metaso API client that uses a configured API key to send user-provided searches, URLs, and chat messages to Metaso.
Install only if you intend to use Metaso as an external service. Do not send secrets, private internal URLs, or sensitive personal data through the search, reader, or chat functions unless that disclosure to Metaso is acceptable.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `simple-test.js` - 简单功能测试
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill documents use of environment variables and external HTTP APIs, but it does not declare a tool scope such as permissions or allowed-tools. This creates a mismatch between documented capabilities and policy-visible permissions, which can cause users or hosting frameworks to underestimate that the skill can access secrets and make outbound network requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation says the skill performs search, URL reading, and chat, but it does not clearly warn that user queries, supplied URLs, and message contents are transmitted to an external Metaso service. This can lead to unintended disclosure of sensitive prompts, internal URLs, or personal data to a third party, especially in agent workflows where users may assume processing is local.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Comments and thrown error messages throughout the file are written in Chinese, including user-visible error text such as the API key configuration and parameter validation messages. This imposes a specific language on users without any opt-in or documented locale constraint, which can violate language/locale policy requirements.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill transmits user-provided search queries, URLs, and chat messages to a third-party service, which can expose sensitive prompts or private data if users are unaware of the disclosure boundary. In an agent skill context, this is more dangerous because upstream callers may pass secrets, internal URLs, or regulated data assuming the tool is local.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's console messages and example chat content are consistently written in Chinese, which imposes a specific language on users. This matches the policy concern for language/locale constraints because there is no opt-in, fallback, or documentation that the skill is intended only for a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language content of the skill forces a specific language/locale for documentation and usage guidance, which can violate the stated policy when there is no opt-in or explicit justification. No alternative language option or region-specific rationale is provided in the file.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code reads METASO_API_KEY from the environment to authenticate outbound requests. While this is common implementation behavior, there is no visible user-facing disclosure, prompt, or warning in this file indicating that the skill depends on and accesses a credential from the runtime environment.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
In metasoListTools, the descriptions say includeSummary controls inclusion of concise raw-text match info, includeRawContent controls recall enhancement via page summaries, and conciseSnippet controls fetching full source-page content. But in the actual search request body, those flags are passed under the same names, while the validation messages describe different meanings: includeSummary as concise match info, includeRawContent as recall enhancement, and conciseSnippet as fetching all source-page raw text. This creates active documentation inconsistency about the intent of each parameter, which can mislead callers about what data the skill will retrieve.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The package description is written entirely in Chinese and indicates the skill is presented as a Chinese-language capability, with no visible opt-in or alternative language support. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation unless clearly justified.
- Content
Static analysis
No suspicious patterns detected.