Security audit

agent-reach

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad web-research router, but it should be reviewed because it can use logged-in browser sessions, cookies, API keys, third-party readers/AI services, and includes some write-capable GitHub commands.

Review this skill before installing. Use it only for web research you are comfortable sending through the listed tools and services. Do not paste raw cookies, private/internal URLs, tokenized links, or sensitive media unless you have a secure handling plan, and avoid the documented GitHub write commands unless you explicitly intend to mutate repositories.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill manifest explicitly says the skill is not for write actions and should only fetch internet content, but this reference includes write-capable GitHub commands such as repo create, issue create, pr create, release create, fork, and clone/sync workflows. In an agent setting, documenting these commands under the skill materially expands the action surface and can cause an agent or operator to perform state-changing operations on GitHub when the skill is expected to be read-only.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: Labeling gh CLI as part of this skill is misleading because the documented usage includes Git operations and write actions that contradict the skill's stated read-only retrieval purpose. This kind of capability mismatch increases the chance of unsafe tool routing, privilege misuse, or accidental repository modification during tasks that should only collect information.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation expands a nominally read-only internet retrieval skill into one that uploads or processes media through external transcription services. That changes the data-flow and trust boundary: user-supplied audio/video or fetched content may be sent to Groq/OpenAI for transcription, which is materially different from simple retrieval and can expose sensitive content or create unexpected external dependencies.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The podcast section explicitly documents LLM-based post-processing to add punctuation and restructure transcript text, which contradicts the stated scope that the skill only fetches internet content and does not perform content processing. This mismatch can cause users or higher-level orchestrators to invoke the skill in situations where transformed content is disallowed, leading to unintended data disclosure to third-party models.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Documenting configuration of Groq/OpenAI API keys for a supposedly read-only retrieval skill introduces unnecessary secret handling and third-party service access. This broadens the attack surface and increases the chance that sensitive fetched media or user-provided content is transmitted to external vendors without a clearly justified need.

Vague Triggers

High

Confidence: 94% confidence
Finding: The skill declares that it MUST USE for broad terms like 'research', 'search', '查', and '找', which are common in everyday requests and not limited to internet retrieval. This can cause over-triggering, route unrelated tasks through external tools, and unnecessarily send user prompts to third-party backends, increasing privacy and data-exposure risk.

Vague Triggers

High

Confidence: 96% confidence
Finding: Triggering on any mentioned platform or any shared URL is overly broad and can capture benign references, pasted links, or sensitive URLs that the user did not intend to fetch through this skill. In a skill that routes to multiple third-party services and CLIs, such broad activation materially raises the chance of unintentional data disclosure or external access.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list contains generic phrases like '搜', '查', '找', '读一下', and '打开这个', which can appear in many non-web contexts. This ambiguity increases the risk that the skill will activate when not needed and forward user content to networked tools without sufficient consent or contextual validation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill heavily relies on third-party services and platform-specific backends, but it does not clearly warn users that their queries, URLs, and fetched content may be transmitted to external providers. That omission undermines informed consent and can expose sensitive prompts, private links, or regulated data to services the user did not expect.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Telling users to provide cookies without a strong warning is dangerous because cookies are bearer credentials that can grant direct access to accounts and private data. Encouraging collection or handling of raw session cookies increases the risk of credential theft, account takeover, and accidental retention in logs or transcripts.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The instructions tell users to configure third-party API keys but do not warn that media or transcript content may be sent to external AI providers. Without a privacy/data-transmission notice, users may unknowingly expose proprietary, personal, or regulated content to Groq/OpenAI during transcription.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The podcast transcription workflow describes Whisper/LLM processing but omits an explicit notice that podcast audio and derived transcript text may be processed by external AI services. This can mislead operators into treating the feature as local or read-only, increasing the risk of accidental disclosure of copyrighted, private, or sensitive spoken content.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation instructs users to fetch arbitrary webpages through third-party services such as r.jina.ai and an MCP web reader, but it does not warn that requested URLs and retrieved content may be sent to external infrastructure. In a research/search skill, users may supply sensitive links, private endpoints, tokenized URLs, or confidential RSS feeds; forwarding those to outside services can leak metadata or content and may also enable unintended access attempts toward internal resources.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.