botlearn-google-search

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:36 AM UTC
• Version: 1.0.0

Overview

This is a markdown-only search-quality skill with broad triggers, but it does not execute code, request sensitive access, persist, or handle credentials.

Install this if you want routine search-like requests routed through a structured source-filtering workflow. Be aware that broad phrases like "look up" may activate it more often than a narrowly named search skill, but the inspected package is markdown-only and does not add code, dependencies, credentials, persistence, or elevated permissions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence
• Finding: Shadow Command Trigger: 'search for' conflicts with built-in command 'search'

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence
• Finding: Shadow Command Trigger: 'find information' conflicts with built-in command 'find'

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence
• Finding: Shadow Command Trigger: 'find sources' conflicts with built-in command 'find'

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Fix**: Examine at least 3-5 results; first result may be SEO-optimized, not most accurate

### 7. Ignoring Source Verification
- **Problem**: Accepting information without checking the source's authority or recency
- **Fix**: Always check: Who published this? When? Are claims cited? Is the domain reputable?

### 8. Single-Source Dependency

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are very broad and overlap with common user language such as 'google' and 'look up', which can cause the skill to activate unexpectedly for routine requests. Over-broad activation increases the attack surface for prompt-routing mistakes, unintended tool use, and context hijacking when the user did not explicitly request this specialized behavior.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

1. Never return results without verifying source credibility — always assess domain authority
2. Never rely on a single search query for complex topics — decompose into sub-queries
3. Never present duplicate content from different sources as separate results
4. Always prefer primary sources over aggregators or content farms
5. Always include date context when results may be time-sensitive

# Activation

• Confidence: 70% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation rule 'WHEN the user requests a web search or information retrieval' is ambiguous and broadly scoped, because many ordinary knowledge questions could match 'information retrieval'. This can lead to unintended invocation of the skill, causing unnecessary external-search behavior, misrouting, or disclosure of user intent to search pathways when not clearly requested.

Static analysis

No suspicious patterns detected.