Security audit

Call Web Search Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a web-research skill, but its instructions try to override system-level instruction priority and require unconditional trust in web/tool results.

Review before installing. The skill does not ship code or persistence, but it contains unsafe instruction-priority language and weak boundaries around web content. It should be revised to respect platform/system instructions, treat retrieved pages as untrusted data, and make submission steps subject to user/runtime authorization.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:13
Finding: Agent Instruction Hierarchy Override and Untrusted Content Hijacking
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill repeatedly mandates a prescribed output language and even frames language mismatches as 'unforgivable,' without grounding that requirement in explicit user choice. This can override user intent, distort task handling, and create instruction-priority conflicts that an attacker could exploit to steer outputs away from the user's requested format or supervisory controls.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly states that user preferences and supervisor instructions should be treated as 'supreme' and can take priority over the system prompt, which attempts to invert the intended instruction hierarchy. This is dangerous because it weakens system-level safeguards and makes prompt injection or unsafe user-directed behavior far more likely to succeed, especially in a tool-using research agent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description is so generic that it does not meaningfully constrain when the skill should be invoked or what boundaries apply. Overly broad invocation criteria increase the chance that the skill is selected in inappropriate contexts, causing the downstream high-authority instructions in the skill to influence tasks they were not meant to govern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.