Open Websearch

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:53 AM UTC
• Version: 0.1.2

Overview

The skill is a coherent web-search setup and retrieval guide, with disclosed setup risks that users should approve deliberately.

Before installing or enabling this skill, confirm any package installs, Playwright browser downloads, daemon startup, and endpoint configuration. Prefer trusted HTTPS endpoints, pinned or lockfile-based npm installs, and avoid insecure TLS except for narrow diagnostics where unauthenticated content is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:117

Finding

Unpinned Playwright Installation and Browser Binary Download

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, line 117
Vulnerability Type: Unpinned third-party dependency and executable artifact download
Risk Level: Medium

Complete Code Snippet:

markdown

- local install: `npm install playwright` and `npx playwright install chromium`

Technical Analysis

The setup workflow instructs the agent to install the latest version of Playwright and then download a Chromium binary. Neither the package version nor the browser artifact is pinned or independently verified.

An npm installation can execute package lifecycle scripts under the privileges of the user running the agent. The resolved package may also depend on the active npm registry and local npm configuration. Consequently, a compromised package release, malicious registry mirror, dependency-resolution attack, or altered browser download path could introduce executable content that was not present during the Skill audit.

The instructions appropriately require user confirmation before installation, which reduces accidental execution, but confirmation does not address package integrity or source authenticity.

Attack Path

1. Browser-assisted retrieval is requested or ordinary request-mode retrieval fails.
2. The agent follows the documented setup path and runs npm install playwright.
3. npm resolves the current package version through the configured registry or mirror.
4. A compromised package, transitive dependency, registry response, or lifecycle script executes during installation.
5. The agent runs npx playwright install chromium, causing an additional executable binary to be downloaded.
6. Malicious installation code or a tampered browser artifact executes with the permissions of the agent's operating-system account.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the installation. This may permit access to file ...[truncated 331 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Playwright to a reviewed exact version rather than resolving the latest release.
• Use a lockfile and prefer a reproducible command such as npm ci.
• Require an approved npm registry and validate that proxy or mirror configuration points to a trusted service.
• Verify package integrity through npm lockfile integrity metadata or an equivalent trusted manifest.
• Pin and verify the downloaded browser revision and artifact checksum where supported.
• Disable unnecessary npm lifecycle scripts when feasible, or perform installation in a restricted sandbox.
• Avoid global installation and run the browser component with the minimum filesystem and network permissions required.
• Continue requiring explicit user approval, but disclose that the operation downloads and executes third-party components.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/engine-selection.md:25

Finding

TLS Certificate Verification Can Be Disabled for Web Fetching

Content

View full analysis

Vulnerability Details

File Location: references/engine-selection.md, line 25
Vulnerability Type: Insecure TLS configuration
Risk Level: Medium

Complete Code Snippet:

markdown

- If `fetchWebContent` fails on a site with a broken certificate chain, only then consider `FETCH_WEB_INSECURE_TLS=true`.

Technical Analysis

The documented fallback permits TLS certificate verification to be disabled for fetchWebContent. Certificate verification establishes that the client is communicating with the intended HTTPS server. Disabling it allows an attacker able to intercept network traffic to present an untrusted certificate and impersonate the destination.

The guidance limits this option to certificate-chain failures and only to page fetching, but it does not require host-level scoping, explicit user confirmation, a temporary lifetime, or restoration of secure defaults. If implemented as a daemon-wide environment variable, the insecure setting may affect more fetches than the single failing request.

Since retrieved pages are consumed by an AI agent, tampered content can also carry false evidence or prompt-injection instructions. The Skill tells the agent to treat fetched pages as untrusted, which mitigates instruction hijacking but does not restore transport authenticity.

Attack Path

1. A target website fails normal certificate validation.
2. The operator or agent enables FETCH_WEB_INSECURE_TLS=true.
3. The agent retries the HTTPS fetch without authenticating the remote certificate.
4. An attacker controlling a network path, proxy, DNS route, or gateway intercepts the request.
5. The attacker supplies modified page content under an invalid or attacker-controlled certificate.
6. The agent receives and may summarize manipulated information as though it came from the intended source.

Impact Assessment

Exploitation can compromise the confidentiality and integrity of affected fetch traffic. ...[truncated 294 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to disable TLS certificate verification.
• Prefer a different trusted source when the target has an invalid certificate chain.
• Repair the system trust store or configure a trusted custom CA when the endpoint is legitimately controlled by the user.
• If insecure TLS must remain available for exceptional diagnostics, require explicit informed confirmation for each affected host.
• Scope any bypass to one hostname and one request rather than a daemon-wide environment variable.
• Restore certificate verification immediately after the diagnostic request.
• Clearly label content obtained without certificate verification as unauthenticated and unsuitable as authoritative evidence.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup.md:78

Finding

Remote HTTP Endpoint Configuration Lacks Explicit Transport and Trust Requirements

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, lines 78-93
Vulnerability Type: Insufficiently constrained remote endpoint configuration
Risk Level: Medium

Complete Code Snippet:

markdown

## Existing HTTP endpoint mode

Use when:
- the user already has a reachable `open-websearch` HTTP endpoint
- the goal is to connect the current workspace, not create a new local server

Stage script:
1. Collect prerequisites.
   - Confirm the endpoint details.
   - Confirm that connecting to the existing endpoint is smaller than creating a new local process.
2. Confirm risky actions.
   - Ask before writing endpoint-related config or switching the current workflow to a different remote/local HTTP service.
3. Perform.
   - Configure CLI or MCP/client access to that endpoint as needed.
4. Validate.
   - Validate connectivity first.
   - Then check that the core tools or equivalent path appear.

Technical Analysis

The workflow permits connection to an existing HTTP endpoint but only requires endpoint details, user confirmation, and connectivity validation. It does not explicitly require HTTPS for non-loopback endpoints, certificate verification, authentication review, or validation that the service is controlled by a trusted party.

Search terms and requested URLs can reveal user interests, investigation targets, private project names, or other contextual information even when the agent does not intentionally transmit credentials or local files. A plaintext or untrusted endpoint can log this data and can manipulate search or fetch responses.

This behavior does not inherently exceed the Skill's functional need because an endpoint is required for remote search. The risk arises from the absence of minimum transport-security and endpoint-authenticity requirements.

Attack Path

1. A user or existing configuration provides a remote open-websearch endpoint.
2. The agent confirms t ...[truncated 937 chars]

Remediation

View remediation

Remediation Suggestions

• Require HTTPS with valid certificate verification for every non-loopback endpoint.
• Permit plaintext HTTP only for explicitly recognized loopback addresses where the traffic cannot leave the host.
• Confirm endpoint ownership, expected operator, authentication requirements, and data-retention policy before configuration.
• Prevent credentials from being embedded directly in endpoint URLs.
• Warn users not to include secrets, private source code, tokens, or unnecessary personal data in search queries.
• Require explicit approval before transmitting queries to a third-party remote endpoint.
• Validate service identity and expected protocol behavior rather than checking connectivity alone.
• Clearly disclose that remote endpoint operators can observe queries and requested URLs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document states to prefer Startpage for general English-language discovery, effectively prescribing an English-language preference in the skill behavior. This is a natural-language locale policy constraint, and the file does not offer user opt-in or explain why English must be preferred in this context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The guidance recommends executing npx playwright without pinning a specific package version, which can cause installation of an unexpected or newly published version at runtime. In a setup skill that instructs users to install and run tooling, this increases supply-chain risk because a compromised or breaking upstream release could be fetched and executed immediately.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.