Security audit

Kimi Websearch

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed web-search skill that sends user search queries to RedFox/Kimi using a named API key, with no evidence of hidden persistence, local data harvesting, or destructive behavior.

Install this only if you are comfortable configuring a RedFox API key and sending search queries to RedFox/Kimi. Use it for public, web-searchable questions where live information is intended, and avoid submitting private, internal, or sensitive text.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation instructs use of environment-based secrets (`REDFOX_API_KEY`) and outbound network access, but the skill declares no explicit permissions. This creates a transparency and policy-enforcement gap: an agent or reviewer may underestimate the skill's ability to access sensitive configuration and make external requests, increasing the chance of unintended secret use or unauthorized data egress.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The usage guidance says users can 'just describe what you need in natural language' and 'no commands to memorize,' which creates very broad activation semantics for the skill. In agent environments, this can cause the skill to trigger on loosely related user text or be selected when the user did not explicitly intend external web search, leading to unintended data disclosure to a third-party API or unnecessary tool use.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Positioning the skill as suitable for 'any question' materially overstates its scope and encourages indiscriminate routing of prompts into a web-search tool. In a tool-using agent, that broad framing increases the chance of sending irrelevant, sensitive, or internal user content to an external search provider without sufficiently explicit consent or need.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases and usage examples are broad, everyday terms such as '联网搜索' and common natural-language requests, which can cause the skill to activate in situations far beyond explicit user intent. In an agent environment, this increases the chance of accidental tool invocation, unintended external network access, and disclosure of user queries to a third-party search provider.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger phrases are broad and repetitive, including generic terms like '联网搜索' and 'AI搜索' that could match many unrelated user requests. Over-broad activation can cause the skill to run unexpectedly, sending user prompts or derived search queries to a third-party service without clear user intent, which raises privacy and data-handling risks in this network-enabled context.

Static analysis

No suspicious patterns detected.