Security audit

Pure Search

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent web-search skill, but it fetches and hands arbitrary third-party page content to agents without enough containment or trust boundaries.

Install only if you are comfortable with the skill sending queries to DuckDuckGo and fetching third-party websites from the runtime environment. Avoid confidential queries, secrets, internal hostnames, or private URLs, and prefer running it in an isolated environment with limited network reach until URL validation, resource limits, dependency pinning, and untrusted-content labeling are added.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

other

Warning

Location: scripts/search.py:76
Finding: Untrusted Search Result Content Is Passed to the Agent Without Prompt-Injection Isolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/search.py:76
Finding: Search Result URLs Are Fetched Without Destination or Resource Validation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:21
Finding: Setup Instructions Install Unpinned and Unnecessary Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill performs network access to DuckDuckGo and arbitrary result URLs, but the manifest does not declare any explicit tool scope or permissions. This creates a transparency and governance gap: agents or users may invoke a network-capable skill without clear policy controls, increasing the risk of unintended outbound requests and data exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description explains functionality but does not warn users that search queries are sent to DuckDuckGo and that fetched URLs/content are retrieved from third-party websites. This omission can lead users or downstream agents to submit sensitive prompts or internal URLs, causing unintended disclosure of private data to external services.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.