The Agent Skills Directory

[SAFE]: The skill is designed with a strong security posture, including explicit instructions for the AI agent to avoid exposing API keys and sensitive user context during search operations.
[COMMAND_EXECUTION]: The skill executes a local bash script mcp-websearch.sh which uses curl to interact with the Bailian API. User-provided queries and result counts are safely handled using jq --arg and jq --argjson respectively, which prevents shell and JSON injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill connects to dashscope.aliyuncs.com, which is the official endpoint for Alibaba Cloud's DashScope services. This is a well-known and legitimate service for the stated purpose of the skill.
[DATA_EXFILTRATION]: Explicit guardrails are included to prevent the agent from piping search results to external network-transmitting commands (e.g., S3 uploads or webhooks), mitigating risks of indirect data exposure.
[CREDENTIALS_UNSAFE]: The skill correctly uses the DASHSCOPE_API_KEY environment variable rather than hardcoding credentials. It contains clear instructions to prevent the agent from echoing or logging this key in conversation or error messages.
[SAFE]: The SAFETY.md file provides comprehensive documentation of the skill's security testing and intended behavior under adversarial scenarios, reinforcing its safety-first design.

bailian-web-search-hardened