Security audit

multi-search-engine

Security checks for vulnerabilities and agentic risk

Overview

This skill builds search-engine URLs locally and discloses its external-search privacy tradeoffs; the noted issues are documentation and scope cautions rather than evidence of hidden or harmful behavior.

Installers should understand that the script itself is local-only, but opening generated URLs sends the query to third-party search engines that may log it. Avoid using this skill for sensitive personal, credential, or confidential-business queries unless you intentionally choose an appropriate privacy engine and review the generated URL first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
- `SKILL.md` — primary instructions and metadata

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger examples are broad, conversational requests that could cause the skill to activate in loosely related contexts without clear boundaries or exclusions. In an agent setting, ambiguous activation increases the chance of unreviewed URL generation for sensitive, policy-relevant, or user-unintended searches, even though this README does not itself execute code or fetch content.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises behavior that leads to file reads and network-relevant URL generation, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity: an agent or runtime may grant broader capabilities than intended, and users cannot easily audit whether the skill is permitted to read local files or trigger web access through downstream tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The examples directly show external requests to third-party search engines without warning that user-supplied queries will be transmitted off-platform. In a privacy-oriented search skill, this omission can mislead users into exposing sensitive terms, research topics, or identifiers to external providers with differing logging and tracking practices.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest frames this skill as building search URLs across engines with filters and compare mode. These lines document password generation, UUID generation, Base64 encode/decode, QR code generation, and URL shortening, which are utility functions rather than search behavior and are not justified by the stated purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This section covers mathematical computation, unit and currency conversion, stock and weather lookups, chemical and nutrition data, flight and IP queries, and similar knowledge-computation use cases. Those capabilities are materially different from building auditable search URLs across search engines and are not clearly justified by the manifest description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest defines a preset named "cn-research" that routes searches to China-specific engines, creating a locale-specific behavior in configuration. There is no accompanying natural-language explanation, opt-in language, or justification in this file indicating that this locale constraint is optional or intended only for region-specific use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language content from the '基本信息' and '本次增强' sections is presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy issue unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language instructions and usage guidance are presented only in Chinese, which can amount to a language policy constraint if users are not given an opt-in choice or an explanation that the skill is intentionally region-specific. The file does mention bilingual search use cases, but it does not offer alternative-language documentation or state that Chinese-only documentation is required for a specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The preset value "cn-research" suggests a China-specific language or locale mode, but the config provides no indication that this locale behavior is optional, user-selected, or justified as region-specific. Under the policy, locale-constraining behavior should be explicitly offered as a choice or clearly documented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The section on language and region filtering gives fixed examples such as hl=en, lr=lang_zh-CN, cr=countryCN, and gl=us, which steer searches into particular language/locale settings. Because the document does not frame these as user-selectable preferences or ask for opt-in, it can violate a language/locale choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains multiple instructional headings and descriptions in Chinese, but does not indicate that the skill is intended specifically for Chinese-speaking users or provide any language/locale opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.