Security audit

smart-search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenCLI search router; it sends user search queries to selected external search sources, but I found no hidden persistence, credential use, destructive behavior, or purpose-mismatched actions.

Install only if you are comfortable with search terms being sent through OpenCLI to external sources such as AI, social, shopping, travel, and media providers, and with the assistant echoing a brief search summary in the response. Specify the platform or language you want when privacy, region, or source choice matters.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The routing guidance tells the agent to use `doubao`, `grok`, or `gemini` for an initial search when the user has not specified a site, which expands behavior beyond the stated OpenCLI-focused scope. This can cause unapproved provider usage, unexpected data flow to external services, and policy bypass if those providers have different trust, logging, or content-handling characteristics.

Vague Triggers

High

Confidence: 92% confidence
Finding: The activation text is extremely broad: it directs use of this skill whenever a user wants to search, query, find, or research information, including many common domains. That can cause the skill to preempt more specialized or privacy-preserving skills and unnecessarily route routine user requests through external search tooling, expanding data exposure and reducing user control over how their request is handled.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The skill says that when the user has not specified a site, the agent should infer language/context and default to one of several AI sources. This imposes language-based routing without explicit user consent, which may send queries to a region- or platform-specific provider the user did not choose, affecting privacy, bias, and compliance expectations.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The skill content strongly biases routing toward Chinese-language sources and examples without requiring explicit user preference, which can override user intent and reduce answer quality for non-Chinese users. In a search-routing skill, defaulting language or locale implicitly can cause misleading results, inappropriate source selection, and privacy or compliance issues if user context is misread.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrase for users who say only 'find videos/reviews/podcasts/articles' is overly broad and lacks exclusions or confirmation steps. In an auto-routing skill, such generic matching can lead the agent to invoke this skill for ambiguous requests, increasing the chance of unintended tool use, privacy issues, or routing to less appropriate sources without user intent being clear.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The site guidance hard-codes language-based preferences such as bilibili for Chinese content and YouTube for English content without requiring user choice. While not directly enabling code execution, it can override user autonomy, bias routing decisions, and send queries to region- or language-specific services that the user did not request.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill requires maintaining a per-query ledger containing `site`, `query`, `count`, and `status`, and then mandates echoing search terms back in every final response. This creates unnecessary retention and disclosure of user queries, which can expose sensitive intents, personal data, or confidential research topics in conversation history and downstream logs.

Static analysis

No suspicious patterns detected.