Multi Search Engine Jarvis

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  2.0.2

Overview

This is an instruction-only search helper that sends user searches to public search engines and does not install code or request special access.

Reasonable to install as a search helper. Do not enter secrets, confidential business terms, private personal data, or sensitive investigative queries unless you are comfortable sending them to the selected search provider; use the advanced search examples only for content and systems you are authorized to research.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs use of third-party search URLs and includes concrete web_fetch examples that transmit user-provided queries to external search engines, but it does not warn users that their searches, IP address, browser/session metadata, and potentially sensitive prompts will be disclosed to those providers. In an agent setting, users may assume queries are handled locally or by the platform, so the missing disclosure meaningfully increases privacy risk even though the behavior is core to the skill's purpose.

VirusTotal

65/65 vendors flagged this skill as clean.