cn-ai-search

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.85). The code intentionally includes hardcoded API keys and explicitly sends collected search queries/results to third‑party services (Tavily via a node script and Jina's r.jina.ai) and invokes external subprocesses (mcporter/node), which creates a high risk of credential leakage and unauthorized data exfiltration even though there is no obvious obfuscated backdoor or remote shell.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). 该Skill在运行时会对外部搜索结果进行网页抓取（如 search_via_jina() 通过 https://r.jina.ai/{url} 读取第三方网页/搜索页的可读文本），并在 tavily_summarize() 中把这些“标题/摘要”拼接成自由文本 prompt 传入LLM（Tavily总结脚本），属于公共网页/第三方内容→LLM上下文的间接提示注入风险。

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill performs runtime HTTP fetches to the Jina Reader proxy (requests.get to URLs of the form https://r.jina.ai/{original_url}) and the fetched text is parsed and injected into the Tavily summary prompt (tavily_summarize), so remote content from https://r.jina.ai directly controls the agent's prompt inputs.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository files for literal credential-like strings. I flagged two high-entropy API keys found in config.py because they are exact, non-placeholder tokens that would grant access if valid:
• TAVILY_API_KEY = "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"
• JINA_API_KEY = "jina_693dbc2621db4af29c3bf7b360b9477c3lN0Es8VoqzAkebJxC2HhTeLzkBB"

Reasoning:

• These are not placeholders (not "YOUR_API_KEY" or similar) and are high-entropy, random-looking strings consistent with real API tokens.
• They are present as literal values in a committed config file (config.py), which meets the definition of a secret (provides service access).
• No other high-entropy secrets (private key PEM blocks, passwords of sufficient entropy) were found. Other values (URLs, command examples, simple words) were ignored per the rules.

Therefore this repository contains active-looking secrets in source.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill's installation steps include creating a symlink in /usr/local/bin and running Docker (and chmod), which modify system-wide state and commonly require elevated privileges, so it pushes the agent/user to change the host system even though it doesn't explicitly request sudo or create accounts.