Web Search Instant 1.1.0

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:14 AM UTC
• Version: 1.0.0

Overview

This is a straightforward DuckDuckGo search helper, but users should avoid sensitive queries and note a few shell-script hygiene issues.

Install only if you are comfortable sending search terms to DuckDuckGo. Do not use it for secrets, private internal project names, credentials, or sensitive personal data; prefer narrowing the trigger rules and remove the npm jq installation suggestion if maintaining the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: web-search.sh:165

Finding

Untrusted API Content Is Interpreted as Terminal Escape Sequences

Content

View full analysis

/dev/null | head -5) # Later output sinks echo -e " $ANSWER" echo -e " $ABSTRACT" echo -e " $DEFINITION" echo "$RELATED_TOPICS" | while read -r topic; do if [ -n "$topic" ] && [ "$topic" != "" ]; then topic_clean=$(echo "$topic" | sed -E 's/]*href="([^"]*)"[^>]*>([^<]*)<\/a>/\2 (\1)/g' | sed 's/<[^>]*>//g') if [ "$OUTPUT_FORMAT" = "markdown" ]; then echo "- $topic_clean" else echo -e " • $topic_clean" fi fi done | head -n "$MAX_RELATED" ``` ### Technical Analysis The script treats fields returned by the DuckDuckGo API as trusted terminal text. Although some fields have carriage returns and line feeds removed, this does not remove other control characters. Moreover, `echo -e` interprets backslash escape notation contained in its arguments. Consequently, a response containing an actual escape character or text such as `\033]...` can cause the terminal to interpret the response as a control sequence rather than display it as inert text. Removing HTML tags from related topics does not mitigate terminal escape-sequence injection. Potential terminal-dependent effects include: - Rewriting or hiding displayed output. - Forging status messages or result boundaries. - Changing terminal titles or hyperlinks. - Trigg ...[truncated 1644 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:166

Finding

Documentation Recommends an Unpinned Global npm Package as jq

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: test-new-features.sh:143

Finding

Predictable Temporary File Allows Symlink-Based File Clobbering

Content

View full analysis

"$TEST_OUTPUT_FILE" 2>&1 if [ -f "$TEST_OUTPUT_FILE" ] && [ -s "$TEST_OUTPUT_FILE" ]; then CONTENT=$(cat "$TEST_OUTPUT_FILE") if [ -n "$CONTENT" ]; then echo -e "${GREEN}✓ PASS${NC} Output successfully written to file" PASSED=$((PASSED + 1)) rm -f "$TEST_OUTPUT_FILE" else echo -e "${RED}✗ FAIL${NC} File is empty" FAILED=$((FAILED + 1)) rm -f "$TEST_OUTPUT_FILE" fi else echo -e "${RED}✗ FAIL${NC} File not created" FAILED=$((FAILED + 1)) fi ``` ### Technical Analysis The test builds a temporary pathname from the process ID and places it in the shared `/tmp` directory. The shell then opens that pathname using normal output redirection. The pathname is predictable and is not created atomically with exclusive semantics. On systems where another local user can create entries in `/tmp`, an attacker can pre-create the expected path as a symbolic link. Shell redirection follows the symbolic link and opens the link target with truncation before `web-search.sh` executes. The later checks with `-f` and `-s` happen only after the unsafe open and cannot prevent the overwrite. The cleanup operation may remove the attacker's link, but it does not restore the truncated target. ### Attack Path 1. A local attacker predicts or sprays likely process-ID-based names matching `/tmp/web-search-test-`. 2. The attacker creates one of those names as a symbolic link to a file writable by the victim. 3. The victim runs `test-new-features.sh`. 4. The shell evaluates: ```bash > "$TEST_OUTPUT_FILE" ``` 5. The shell follows the pre-existing symbolic ...[truncated 927 chars]

Remediation

View remediation

&2 exit 1 } ``` 2. Register cleanup immediately so the file is removed on normal exit, errors, or signals: ```bash trap 'rm -f -- "$TEST_OUTPUT_FILE"' EXIT HUP INT TERM ``` 3. Keep the pathname quoted and use `--` for cleanup commands: ```bash "$TOOL" --format plain "test" >"$TEST_OUTPUT_FILE" 2>&1 ``` 4. Do not run the test suite with elevated privileges. 5. Where temporary files are unnecessary, capture output directly into a shell variable or use a private temporary directory created with `mktemp -d`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This second mismatch finding points to the same core issue: the skill is presented as a simple web search interface, but operational details suggest additional filesystem and execution behaviors outside that stated purpose. When a skill fronts a local executable instead of transparently implementing the API interaction, the reviewed surface and the executed surface diverge, increasing the chance of abuse or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This second mismatch finding points to the same core issue: the skill is presented as a simple web search interface, but operational details suggest additional filesystem and execution behaviors outside that stated purpose. When a skill fronts a local executable instead of transparently implementing the API interaction, the reviewed surface and the executed surface diverge, increasing the chance of abuse or policy bypass.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

## API Details

- **Endpoint**: `https://api.duckduckgo.com/`
- **Parameters**:
  - `q` - Search query (URL-encoded)
  - `format=json` - JSON response

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

Some abstracts have Unicode issues in basic parsing (non-ASCII characters garbled). Install jq for cleaner output:

bash

sudo apt-get install jq  # Ubuntu/Debian
brew install jq          # macOS

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Some abstracts have Unicode issues in basic parsing (non-ASCII characters garbled). Install jq for cleaner output:

bash

sudo apt-get install jq  # Ubuntu/Debian
brew install jq          # macOS

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation describes use of shell and network capabilities but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, undeclared capabilities reduce policy enforcement and reviewability, making it easier for a seemingly simple search skill to execute local commands or make outbound requests beyond what operators expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad, including common language like 'what is' and 'how to', which can cause the skill to activate in situations far beyond intended web search usage. Over-invocation increases exposure to network and shell actions, can leak user context to external services, and may override more appropriate safer skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents a web search tool that sends the user's query to the DuckDuckGo Instant Answer API, which is a network operation involving user-provided data. The description explains the endpoint and parameters but does not warn users that their queries will be sent to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This shell test script repeatedly invokes ./web-search.sh with live search queries, which likely triggers network/HTTP requests. While the script prints test names and pass/fail output, it does not disclose that running the tests may send queries off-host, and there is no comment or prompt warning the user about that behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends the user's search query to DuckDuckGo over the network, but it does not provide an explicit user-facing privacy warning at the point of transmission. This can expose sensitive user-entered data if the tool is used with private, internal, or confidential queries, especially in an agent setting where users may not realize their input leaves the local environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.