Everything-Search-Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:43 AM UTC
• Version: 0.1.0

Overview

This skill is mostly a coherent local file search helper, but it can automatically start local programs and persist executable paths during ordinary searches without a clear confirmation step.

Install only if you are comfortable with the agent invoking Everything/es.exe, starting Everything automatically, and saving executable paths in path.env. Review or pin the configured paths first, especially ES_PATH and EVERYTHING_PATH, and avoid using this in managed or sensitive environments without adding explicit confirmation and trusted-path validation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (26)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises behavior that includes executing local scripts, invoking es.exe, reading environment state, and potentially writing configuration, but it does not declare any tool scope or permission boundaries. This creates an authorization and transparency gap: an agent may invoke shell/file capabilities that the user did not clearly consent to, increasing the risk of unintended local actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger condition is broad enough to activate on many ordinary requests involving files, which can cause the skill to run in contexts the user did not specifically intend. Over-broad activation increases the chance of unnecessary filesystem enumeration and command execution, especially when paired with automatic setup or background-start behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown activation guidance remains insufficiently constrained and does not clearly separate safe read-only search from setup or process-management side effects. In agentic environments, vague activation text can lead to unintended execution on loosely related prompts and expose local file metadata more often than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it may automatically start Everything in the background, but the description does not prominently warn the user about this side effect before activation. Starting a background process changes system state and may alter privacy expectations, particularly because Everything maintains a local file index and exposes broad file metadata search capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module description and user-facing metadata are written only in Chinese, and the rest of the script continues this pattern for prompts and status messages. This imposes a specific language on users without opt-in, which matches the locale-policy violation criteria for natural-language content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 94)May include surrounding context.

python

es.exe 的完整路径，未找到返回 None
    """
    try:
        result = subprocess.run(
            ["wmic", "process", "where", "name='Everything.exe'", "get", "ExecutablePath"],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

A file-search skill using es.exe is expected, but this installer/discovery module also enumerates processes and launches native executables to inspect and start system components. That subprocess-control capability is not explicitly justified by the manifest’s user-facing purpose of local file retrieval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a local file search skill triggered for finding files, which implies querying an existing indexer/CLI. In addition to discovery, this code proactively starts Everything in the background via start_everything_background(), introducing process-launching behavior beyond simple file search/query operations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 233)May include surrounding context.

python

try:
        if is_wsl():
            # WSL 环境：使用 cmd.exe 调用 tasklist
            result = subprocess.run(
                ["cmd.exe", "/c", "tasklist", "/FI", "IMAGENAME eq Everything.exe"],
                capture_output=True, text=True, encoding="utf-8", errors="replace",
                timeout=10

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 240)May include surrounding context.

python

)
        elif sys.platform == 'win32':
            # Windows 原生环境
            result = subprocess.run(
                ["tasklist", "/FI", "IMAGENAME eq Everything.exe"],
                capture_output=True, text=True, encoding="utf-8", errors="replace"
            )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

This launches everything_exe from a path that can be sourced from environment variables or writable config, so a local attacker who can influence those sources could cause the script to execute an arbitrary binary. In an install/discovery script, automatic background execution increases risk because execution can occur without explicit user review at the moment of launch.

Content

Scanner excerpt · scripts/install.py (reported line 268)May include surrounding context.

python

try:
        if is_wsl():
            # WSL 环境：直接执行 /mnt/c/.../Everything.exe
            subprocess.Popen(
                [everything_exe, "-startup"],
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
            )

Tainted flow: 'everything_exe' from os.environ.get (line 396, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow
• Confidence: 97% confidence

Finding

This is a true tainted-path execution issue: everything_exe can flow from EVERYTHING_PATH or persisted config into subprocess.Popen, allowing arbitrary executable launch if those inputs are manipulated. In a local skill installer, this is especially risky because environment variables and adjacent config files are commonly writable by the invoking user or a malicious wrapper process.

Content

Scanner excerpt · scripts/install.py (reported line 268)May include surrounding context.

python

try:
        if is_wsl():
            # WSL 环境：直接执行 /mnt/c/.../Everything.exe
            subprocess.Popen(
                [everything_exe, "-startup"],
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
            )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

This Windows-native Popen invocation executes everything_exe after discovery from environment/config/path sources, creating the same arbitrary local code execution risk as the WSL branch. The danger is contextualized by the script's auto-discovery behavior: it may launch the resolved binary automatically as part of setup rather than after explicit trust confirmation.

Content

Scanner excerpt · scripts/install.py (reported line 274)May include surrounding context.

python

)
        elif sys.platform == 'win32':
            # Windows 原生环境
            subprocess.Popen(
                [everything_exe, "-startup"],
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                creationflags=subprocess.CREATE_NO_WINDOW

Tainted flow: 'everything_exe' from os.environ.get (line 396, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow
• Confidence: 97% confidence

Finding

This duplicates the tainted executable-launch issue in the Windows branch: an attacker-controlled everything_exe path reaches subprocess.Popen and results in arbitrary process execution. The list-argument form avoids command injection syntax issues but does not mitigate execution of a malicious binary chosen through tainted path resolution.

Content

Scanner excerpt · scripts/install.py (reported line 274)May include surrounding context.

python

)
        elif sys.platform == 'win32':
            # Windows 原生环境
            subprocess.Popen(
                [everything_exe, "-startup"],
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                creationflags=subprocess.CREATE_NO_WINDOW

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

The script executes es_path -version, but es_path may come from ES_PATH, EVERYTHING_PATH, PATH, or path.env, all of which are attacker-influenceable in many local threat models. Even though the argument list form avoids shell injection, it still results in arbitrary program execution if a malicious executable is placed at the resolved path.

Content

Scanner excerpt · scripts/install.py (reported line 417)May include surrounding context.

python

# 测试 es.exe 是否可运行
    if os.path.isfile(es_path):
        try:
            result = subprocess.run(
                [es_path, "-version"],
                capture_output=True,
                text=True,

Tainted flow: 'es_path' from os.environ.get (line 145, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 97% confidence

Finding

This is a true tainted-flow vulnerability because es_path can originate from environment variables, PATH lookup, or path.env and is then executed. An attacker who controls any of those path sources can substitute a malicious binary that will be run during verification.

Content

Scanner excerpt · scripts/install.py (reported line 417)May include surrounding context.

python

# 测试 es.exe 是否可运行
    if os.path.isfile(es_path):
        try:
            result = subprocess.run(
                [es_path, "-version"],
                capture_output=True,
                text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script automatically writes or overwrites path.env during discovery without explicit consent in the non-interactive path, which can silently persist attacker-influenced executable paths for later execution. While this is not remote compromise by itself, it creates a persistence and trust-boundary problem that amplifies the tainted-path execution issues elsewhere in the skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/search_core.py (reported line 203)May include surrounding context.

python

cmd.append(query)

    try:
        result = subprocess.run(cmd, capture_output=True, timeout=30)

        if result.returncode != 0:
            error_msg = _decode_bytes(result.stderr).strip()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file advertises a local search capability, but the main flow also performs automatic discovery/configuration and starts external software when prerequisites are missing. That hidden side effect expands the skill from read-only search into environment modification and process control, which can surprise users and violate least-privilege expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script may start Everything automatically during a normal search flow without upfront disclosure, creating a hidden side effect. In agent-driven execution, undisclosed process creation is particularly concerning because it can violate user expectations and organizational policy even if the target program is legitimate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

After successful searches, the script persists discovered paths to path.env without explicit user approval. Silent state writes create an undeclared persistence mechanism and may expose sensitive local installation paths or alter later behavior in ways the user did not request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Automatic configuration writes occur without prior warning or consent, which is risky for a utility that users may assume is read-only. Unannounced persistence can create audit, privacy, and trust issues, especially in managed or multi-user environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script automatically performs installation/discovery/configuration when es.exe is not found, exceeding the stated purpose of the skill. In practice, this can modify the environment and trust newly discovered binaries without a clear user decision, increasing attack surface if path discovery is subverted elsewhere.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatically launching a background process is an extra capability beyond simple file search and can change host state without a clear opt-in. In an agent skill context, such implicit execution is more dangerous because the caller may expect a passive lookup tool, not software lifecycle management.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The setup flow indicates that install.py may discover es.exe and save its path to path.py, but this write behavior is not clearly disclosed to the user. Undisclosed configuration writes are a transparency and trust issue because they modify local files even if the primary skill purpose appears to be read-only searching.

Content

No source excerpt is available for this finding.