The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script websearch.py contains a hardcoded secret key (APP_KEY = "38d2391985e2369a5fb8227d8e6cd5e5") used to generate MD5 signatures for API authentication.
[DATA_EXFILTRATION]: The skill initiates network requests to a local service at http://127.0.0.1:53699/get_token to fetch bearer tokens and sends search queries to the external ZhipuAI API endpoint at https://autoglm-api.zhipuai.cn/agentdr/v1/assistant/skills/web-search.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes 'snippet' and 'title' data from arbitrary third-party websites during the search process. This untrusted content is then presented to the agent, providing an attack surface for instructions embedded in web content to influence agent behavior.

autoglm-websearch