AnySearch

• Outcome: Review
• Latest audit: Jul 27, 2026 · 11:18 AM UTC
• Version: 3.0.1

Overview

The skill is a real search integration, but it also encourages agent-run account registration, sending a real email to AnySearch, and storing API keys in local files, which needs review before installation.

Install only if you are comfortable sending search queries, URLs, and optionally an API key to AnySearch. Prefer anonymous mode or manual browser signup, avoid giving the agent a personal email for automatic registration unless you intend to create an account, and store API keys in a secret manager or environment variable rather than a plaintext .env file when possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to perform network access, shell execution, environment-variable access, and file reads/writes, yet it declares no corresponding permissions. This creates a transparency and policy-enforcement gap: an agent or platform may execute capabilities users did not explicitly authorize, including writing `.env` files and sending queries/API keys to a remote service.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: 该 README 明确指示智能体向远端服务发起注册请求、代表用户创建账户并获取 API key，这超出了“搜索/提取”这一技能的最小必要权限范围。即使目的是便捷配置，这也会驱动代理收集个人邮箱并执行外部账户操作，增加隐私、越权自动化和误注册风险。

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: README 要求智能体把返回的明文 API key 写入本地 `.env`，赋予了该技能不必要的本地凭据持久化能力。凭据落盘可能导致被其他进程、错误提交、日志/备份或共享目录读取，从而扩大密钥泄露面。

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: 该文档要求智能体探测本地运行时、执行多种 shell 命令并测试多个 CLI，这将技能能力从远程搜索扩展到本地环境枚举与命令执行。虽然用于安装验证，但对一个搜索技能而言权限面过宽，可能被滥用于环境侦察、执行非预期代码或触发本地副作用。

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: 将运行时选择持久化写入 `runtime.conf` 本身风险低于凭据写入，但仍属于对本地文件系统的修改能力，超出纯搜索功能的核心边界。若代理可任意重写配置，可能影响后续调用路径，造成持久化的错误配置或被利用为后续执行铺路。

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly instructs the agent to persist a one-time plaintext API key into a local .env file, but does not require user consent or warn about local secret storage risks. This can expose credentials through filesystem access, backups, logs, accidental commits, or other tools that read the workspace, especially because the key is surfaced only once and may be treated casually.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to collect a real email address and transmit it to a third-party registration endpoint without an explicit privacy disclosure or consent checkpoint. That creates a privacy and data-sharing risk because personally identifiable information is sent off-platform and used to create an external account tied to the user.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: 文档要求把 API key 写入 `.env`，但没有同步给出凭据落盘的风险提示、最小权限建议、文件权限控制或轮换方案。这会让代理或用户在不了解后果的情况下持久化敏感信息，增加密钥泄露和长期滥用风险。

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: 文档指示智能体收集真实邮箱并发送到第三方注册接口，却缺少清晰的数据传输、隐私处理和第三方服务告知。对搜索技能来说，这种额外 PII 收集并非核心必需，若无充分告知与同意，容易造成隐私合规和用户信任问题。

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The activation criteria are very broad, covering generic information retrieval, fact-checking, browsing, and multi-intent queries, which can cause the skill to trigger for a large fraction of user requests. In context, that increases the chance of unnecessary external network calls and routing user queries to a third-party provider even when a less-privileged or local capability would suffice.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The extract command forwards a user-supplied URL to a remote AnySearch API, which causes network transmission of potentially sensitive internal or private URLs. In an agent setting, users may not realize that the URL itself and associated request metadata are disclosed to a third party, creating privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script accepts an API key via the `--api_key` command-line flag, which can expose the secret through process listings, shell history, audit logs, or job control output on multi-user systems. While this is a common convenience feature, it creates a real credential-handling weakness because the script provides no warning and encourages an unsafe secret transport method.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The specification instructs the agent to save an API key to .env after obtaining user approval, but it provides no guidance on secure secret storage, file permissions, redaction, or avoiding persistence in shared/workspace directories. In an agent context, this can lead to long-lived credential exposure through source control, logs, artifact uploads, or multi-tenant workspace reuse.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**[IMPORTANT!] Registration instructions can be found in this section: ### Register for an API Key (Recommended)**

Get started in 30 seconds: Register with just an email address. The AI agent will complete the whole process automatically, no verification code required.

[Jump to registration steps →](#register-for-an-api-key-recommended)

• Confidence: 86% confidence
• Finding: no verification

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| starts with `Key creation failed.` | account created but key failed — extract the email and URL from the message (`"Key creation failed. Your account <email> was created; sign in at <url>."`) and tell the user to sign in there to create a key manually |
| `Internal server error.`          | retry later or fall back to anonymous                                                               |

> The email **must be real and reachable** — the password is delivered there. There is **no verification code** in this flow; the agent only ever asks for an email. Registration and anonymous use are mutually exclusive; once the user picks one, don't switch mid-flow.

### How to configure

• Confidence: 84% confidence
• Finding: no verification

Credential Access

High

• Category: Privilege Escalation

Content

When a new key is obtained via auto-registration, the agent MUST:
1. Ask the user for explicit confirmation before saving the key to disk.
2. Inform the user: "A new API key was received. Save it to .env for future use?"
3. Only after user approval, update the `.env` file.
4. Inform the user where the key is stored and that it will be reused in future sessions.

• Confidence: 90% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Dependency for the Python CLI (scripts/anysearch_cli.py).
# The Node.js, Bash and PowerShell CLIs require nothing from this file.
#   pip install -r requirements.txt
requests>=2.20

• Confidence: 95% confidence
• Finding: requests>=2.20

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.