Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Bing RSS search helper whose network behavior is disclosed and matches its purpose.
Install only if you are comfortable sending search terms to Bing. Avoid searching for secrets, credentials, private customer data, or confidential internal terms through this skill.
The skill documents and encourages network and shell-capable execution paths, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent or operator may invoke the skill without clear consent boundaries for outbound network access or shell execution, increasing the chance of unintended data egress or unsafe command use.
The skill tells users how to perform searches but does not clearly warn, near usage, that the query text will be transmitted to Bing over the network. This can lead users to unknowingly send sensitive prompts, internal terms, or personal data to a third-party service.
The skill is tied to a single provider/context and does not give users a choice of search backend or locale behavior. While not directly exploitable like code injection, this can create privacy, compliance, or trust issues if users are unaware that all searches are routed to that specific provider and regional result context.
The script sends the user's raw search query to Bing over the network without any notice, consent prompt, or privacy warning. While this is the core function of a web search tool and not evidence of malicious behavior, it can expose sensitive user-entered data to an external third party if users do not realize their input leaves the local environment.
No suspicious patterns detected.
