ClawHub
Back to skill

Security audit

Kimi Websearch

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a straightforward Kimi/RedFox web-search integration, with the main caution that searches are sent to an external service using a RedFox API key.

Install this only if you are comfortable using RedFox/Kimi as the search provider. Treat anything you ask it to search as data sent to that service, keep REDFOX_API_KEY scoped and revocable, and prefer a pinned dependency install for requests in managed environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:64
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Unpinned dependency and insufficient package integrity controls
Risk Level: Low

Vulnerable Code

bash
pip3 install requests

Technical Analysis

The installation instruction resolves the requests package without specifying a reviewed version, cryptographic hashes, a lockfile, or an explicit trusted package index. Consequently, the dependency installed in the future may differ from the version present when the Skill was audited.

Although requests is a legitimate and widely used package, this installation pattern does not protect against compromise of a future release, package-index substitution through local pip configuration, or installation of an incompatible release. Package code may execute during installation and will execute when imported by scripts/kimi_search.py.

Attack Path

  1. An attacker compromises a future release of the dependency or influences the package index used by the victim's pip configuration.
  2. A user or agent follows the documented pip3 install requests instruction.
  3. Pip resolves and installs the attacker-controlled or otherwise unreviewed package version.
  4. Malicious package code executes during installation or when kimi_search.py imports requests.
  5. The code runs with the privileges of the user invoking pip or the Skill and can access resources available to that process.

This attack requires compromise or substitution of the dependency distribution path; the repository itself does not contain a malicious dependency.

Impact Assessment

Successful exploitation could provide code execution with the invoking user's privileges. Depending on the runtime environment, attacker-controlled dependency code could access local files readable by that user, environment variables such as REDFOX_API_KEY, the submitted search query, and available network resources. The impact is li ...[truncated 93 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin requests and its transitive dependencies to versions that have been reviewed and tested.
  • Store dependency versions in a committed requirements or lock file.
  • Record and enforce cryptographic hashes with pip's --require-hashes option.
  • Use an explicitly approved package index rather than relying on mutable local pip configuration.
  • Automate dependency vulnerability scanning and controlled update review.

Example hardened installation workflow:

bash
python3 -m pip install \
  --index-url https://pypi.org/simple \
  --require-hashes \
  -r requirements.txt

The associated requirements.txt should contain exact versions and verified SHA-256 hashes for every direct and transitive dependency.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tainted flow: 'headers' from os.environ.get (line 47, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/kimi_search.py (reported line 54)May include surrounding context.

python
# ── Step 1: 提交搜索 ──────────────────────────────────────────────
    try:
        submit_resp = requests.post(
            f"{API_BASE}/submit",
            json={"inquiry_text": query, "source": source},
            headers=headers,

Tainted flow: 'headers' from os.environ.get (line 47, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/kimi_search.py (reported line 86)May include surrounding context.

python
time.sleep(POLL_INTERVAL)

        try:
            result_resp = requests.post(
                f"{API_BASE}/result",
                json={"taskId": task_id},
                headers=headers,

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README describes activation through very broad natural-language requests such as general search or real-time information queries, without clear boundaries on when this skill should be invoked instead of other tools. In an agent environment, this can cause over-triggering and unintended transmission of user prompts to an external web-search provider, increasing privacy, data exposure, and prompt-routing risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The entire user-facing README is written only in Chinese, including usage instructions and examples, with no indication that other languages are supported or that the user may choose a preferred language. This can violate language/locale policy when a skill imposes one language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented trigger phrases are broad, everyday terms such as '联网搜索' and 'AI搜索' that can appear in normal user conversation, increasing the chance the skill is invoked unintentionally. In an agent environment, accidental activation can cause unplanned outbound requests, unnecessary API usage, and unintended disclosure of user queries to a third-party search provider.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill uses environment variables and makes external network requests, but it declares no explicit tool scope or permission boundaries. This weakens reviewability and policy enforcement, making it easier for an agent to invoke a networked, credential-using skill without clear upfront authorization constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation language is broad enough that the skill may trigger for generic requests like 'search' or 'AI search' without clear user intent to use this specific third-party service. Over-broad triggering can cause unintended data disclosure by sending user prompts or sensitive context to an external provider when the user did not explicitly consent to that path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill does not clearly warn users that their queries will be transmitted to a third-party API service. In a search skill, this context makes the issue more dangerous because user requests may contain sensitive business, personal, or credential-adjacent information that gets exfiltrated outside the local agent environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language documentation entirely in Chinese, and the runtime error/progress messages are also presented only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kimi_search.py (reported line 54)May include surrounding context.

python
# ── Step 1: 提交搜索 ──────────────────────────────────────────────
    try:
        submit_resp = requests.post(
            f"{API_BASE}/submit",
            json={"inquiry_text": query, "source": source},
            headers=headers,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kimi_search.py (reported line 86)May include surrounding context.

python
time.sleep(POLL_INTERVAL)

        try:
            result_resp = requests.post(
                f"{API_BASE}/result",
                json={"taskId": task_id},
                headers=headers,