Everything Cli Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:36 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a Windows file-search helper, but it includes an unsafe Bash wrapper and risky remote-access and deletion guidance that need review before installation.

Install only if you are comfortable with Everything indexing your local filesystem. Avoid the Bash wrapper until eval is removed, do not copy the forced-delete PowerShell example, and enable HTTP/ETP servers only on trusted networks with strong access controls and a clear need.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/es_search.sh:40
• Finding: Shell Command Injection Through eval in the Bash Wrapper<![CDATA[ ## Vulnerability Details **File Location**: `scripts/es_search.sh`, lines 40-72 and 143-167 **Vulnerability Type**: OS command injection caused by unsafe command reconstruction and `eval` **Risk Level**: High ### Vulnerable Code ```bash build_cmd() { local cmd=("$ES_PATH") # Add options if [[ -n "$ES_PATH_ARG" ]]; then cmd+=("-p" "$ES_PATH_ARG") fi if [[ "$ES_REGEX" == "true" ]]; then cmd+=("-regex") fi if [[ "$ES_CASE" == "true" ]]; then cmd+=("-case") else cmd+=("-nocase") fi if [[ "$ES_WHOLE_WORD" == "true" ]]; then cmd+=("-wholeword") fi if [[ "$ES_MATCH_PATH" == "true" ]]; then cmd+=("-matchpath") fi if [[ -n "$ES_SORT" ]]; then cmd+=("-sort" "$ES_SORT") fi if [[ "$ES_SORT_DESC" == "true" ]]; then cmd+=("-sort-descending") fi if [[ "$ES_DETAILS" == "true" ]]; then cmd+=("-details") fi # Add query cmd+=("$ES_QUERY") echo "${cmd[@]}" } ``` ```bash # Build command local cmd cmd=$(build_cmd) # Execute search info "Searching for: $ES_QUERY" if [[ -n "$ES_PATH_ARG" ]]; then info "Path: $ES_PATH_ARG" fi # Run command if [[ "$ES_JSON" == "true" ]]; then # Output as JSON local output output=$(eval "$cmd" 2>&1) echo "$output" | jq -R 'split("\n") | map(select(length > 0)) | map({path: .})' 2>/dev/null || echo "$output" else # Output as text eval "$cmd" fi ``` ### Technical Analysis The script initially constructs the command as a Bash array, which would normally preserve argument boundaries. However, `build_cmd` serializes that array into a plain string using `echo`, and the caller subsequently executes the string with `eval`. Values controlled by the caller—including the search query, path, sort field, and `ES_PATH` environment variable—therefore undergo a second round of shell parsing. Shell separators, substitutions, redirections, and other metacharact ...[truncated 1445 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all use of `eval`. - Construct and execute the command in the same function while retaining it as a Bash array: ```bash cmd=("$ES_PATH") if [[ -n "$ES_PATH_ARG" ]]; then cmd+=("-p" "$ES_PATH_ARG") fi # Add other options as separate array elements. cmd+=("$ES_QUERY") if [[ "$ES_JSON" == "true" ]]; then output=$("${cmd[@]}" 2>&1) else "${cmd[@]}" fi ``` - Do not return arrays through `echo` and command substitution. - Resolve `ES_PATH` to an approved executable and reject unexpected executable paths where the environment is not fully trusted. - Validate options that have a finite set of permitted values, such as sort fields. - Add regression tests containing spaces, semicolons, command substitutions, redirections, and quotes to verify that every supplied value remains a single literal argument. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:1004
• Finding: Remote File Access Guidance Omits Required Network Security Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 1004-1017 **Vulnerability Type**: Insecure network service configuration guidance **Risk Level**: Medium ### Vulnerable Documentation ```markdown ## HTTP Server Everything can start a web server to access your files from your phone or other device. ### Start HTTP Server - In Everything, go to **Tools** → **Options** → **HTTP Server** - Check **Enable HTTP server** - Set port (default: 80) - Click **OK** ### Access HTTP Server Open your browser and navigate to: ``` http://localhost:80 ``` ``` ### Technical Analysis The instructions encourage enabling a web server that provides access to indexed files but do not require authentication, interface binding restrictions, firewall allowlisting, transport encryption, or verification that the service is reachable only from trusted hosts. Although the access example uses `localhost`, this does not establish that the server itself is bound exclusively to the loopback interface. The actual exposure depends on the user's Everything configuration, host firewall, and network topology. Port 80 also provides unencrypted HTTP. ### Attack Path 1. A user follows the documented steps and enables Everything's HTTP server. 2. The server is configured to listen on a LAN-accessible interface, either by default or through existing settings. 3. No authentication or source-address firewall restriction is configured because the guide does not require one. 4. Another host with network reachability connects to the service. 5. The remote party searches, enumerates, or accesses content exposed by the Everything server, subject to the server's configured capabilities and indexed scope. This path is conditional on the server listening beyond loopback, but the documentation does not instruct the user to verify or prevent that condition. ### Impact Assessment Potential impact includes disclosure of filenames, directory structures, search results, and files made a ...[truncated 471 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make loopback-only binding the documented default and require users to verify the listening address. - Require strong authentication before allowing any non-loopback access. - Restrict inbound firewall rules to explicitly trusted source addresses. - Warn users not to expose the service directly to the public internet. - For remote access, recommend a trusted VPN or an authenticated TLS reverse proxy rather than plain HTTP. - Document how to limit the indexed and shared scope so sensitive directories are not exposed. - Include a post-configuration verification step, such as checking listening interfaces and testing access from an untrusted host. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: EXAMPLES.md:731
• Finding: Destructive PowerShell Cleanup Example Deletes Unreviewed Search Results<![CDATA[ ## Vulnerability Details **File Location**: `EXAMPLES.md`, lines 731-735 **Vulnerability Type**: Unsafe forced file deletion **Risk Level**: Medium ### Vulnerable Code ```powershell # Find and delete old temp files $oldTemp = es.exe "*tmp* datemodified:last30days" foreach ($file in $oldTemp) { Remove-Item $file -Force } ``` ### Technical Analysis The example globally searches for any path containing `tmp` and directly passes every result to `Remove-Item -Force`. It does not constrain the search to an approved temporary directory, verify that each result is a regular temporary file, present results for review, or request confirmation. The query description and predicate also conflict: `datemodified:last30days` selects files modified during the last 30 days rather than files older than 30 days. Consequently, recently modified legitimate files can be selected. The deletion command does not use `-LiteralPath`, so filenames containing PowerShell wildcard characters may be interpreted as patterns and could affect additional paths. ### Attack Path 1. A user copies the cleanup example from the documentation. 2. Everything returns globally indexed files whose names or paths contain `tmp` and which were modified in the last 30 days. 3. A legitimate or attacker-created matching path is included in the output. 4. The loop passes the result directly to `Remove-Item`. 5. PowerShell deletes the item with `-Force`, without review or confirmation. 6. If a returned path contains wildcard metacharacters, PowerShell may resolve it as a pattern rather than as one exact path. ### Impact Assessment The example can cause deletion of legitimate user data within the privileges of the invoking account. When executed from an elevated PowerShell session, the deletion scope can include protected or system-wide paths accessible to the administrator. The likely result is data loss or application disruption. The example does not itself grant new privileges, but it perfo ...[truncated 83 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Restrict the search to a specific, explicitly approved temporary directory. - Correct the date predicate so it actually selects files older than the intended retention period. - Require a review stage before deletion. - Use `Remove-Item -LiteralPath` to prevent wildcard interpretation. - Use `-WhatIf` in the default example and require explicit user confirmation before destructive execution. - Validate that every result is a regular file located beneath the approved cleanup root. - Avoid `-Force` unless there is a documented, necessary reason. A safer pattern is: ```powershell $tempRoot = [System.IO.Path]::GetFullPath($env:TEMP) $candidates = es.exe -p $tempRoot "*.tmp datemodified:<last30days" $candidates | ForEach-Object { $candidate = [System.IO.Path]::GetFullPath($_) if ($candidate.StartsWith($tempRoot, [System.StringComparison]::OrdinalIgnoreCase) -and (Test-Path -LiteralPath $candidate -PathType Leaf)) { Remove-Item -LiteralPath $candidate -WhatIf } } ``` Users should inspect the `-WhatIf` output before replacing simulation with an explicitly confirmed deletion operation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Ae1

High

• Category: analysis-evasion

Content

es -p "F:\openclaw-skills" "SKILL.md"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The script constructs a shell command from user-controlled inputs and executes it with eval, which re-parses the generated string as shell syntax. Inputs such as the query, search path, sort field, or even ES_PATH can inject command separators or substitutions, turning a file-search wrapper into arbitrary command execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The PowerShell example pipes search results into `Remove-Item -Force` without any confirmation, preview, path validation, or safety warning. Because the search pattern is broad and the date filter is mislabeled, users could unintentionally mass-delete files, causing data loss or destructive cleanup beyond what they intended.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The document content is presented in Vietnamese throughout, including setup steps, troubleshooting, and usage guidance. Because the file does not offer an alternative language or indicate that the skill is intentionally restricted to Vietnamese-speaking users, it appears to impose a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README promotes remote access features such as HTTP and ETP server support without warning that they can expose indexed file names, paths, and potentially file access to other devices on the network. In a search/indexing tool, this omission can lead users to enable remote features without understanding the privacy and attack-surface implications.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The tip to use the HTTP server for remote access encourages exposing search capability to another device without warning that this may disclose file names, paths, metadata, or content access beyond the local machine. Because the README frames this as a convenience feature, users may enable it casually and unintentionally expose sensitive data on a home or corporate network.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to enable Everything's HTTP server to access indexed files remotely, but it does not warn that this exposes file metadata and potentially sensitive local file access over the network. In a security-sensitive agent skill, omitting authentication, binding, firewall, and exposure guidance can lead users to unintentionally publish local file information beyond localhost or weaken host security posture.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill recommends enabling the ETP/FTP server and even shows a credential-bearing connection string, but it does not discuss risks such as network exposure, weak transport security, credential leakage, or unintended remote browsing of indexed files. Because this feature is specifically for remote search and access, the lack of security caveats materially increases the chance of unsafe deployment.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The use of eval here is itself the core vulnerability, not merely a UX issue about missing warning text. Because the command string contains attacker-influenced values, eval enables arbitrary shell execution immediately and silently, which is especially dangerous in an agent skill context where parameters may come from higher-level automation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.append(final_query)

        try:
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The docstring for search_in_directory says it searches within the provided directory path, but when recursive is False the code stores kwargs["parent"] = path and calls self.search(query, **kwargs). The search method has no parent parameter and only honors its path argument, so this branch does not constrain results to the specified directory as documented.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The example `es.exe -admin "test"` demonstrates elevated execution without warning about privilege implications. While it is only an example command, normalizing unnecessary administrator use can encourage users to run commands with elevated rights, increasing risk if combined with other mistakes or unsafe follow-on actions.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: The inline comment at L739 describes locating 'old temp files', but the command at L740 uses `datemodified:last30days`, which conventionally means recently modified within the last 30 days. This is an intent/documentation mismatch in the example itself, not just an omitted detail.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The instructions tell users to enable the Everything service for real-time indexing but do not explain that this creates continuous, system-wide file metadata monitoring and may broaden visibility across volumes and users depending on configuration. While not inherently unsafe, omitting this context can cause users to enable a persistent service without understanding privacy and operational implications.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The code provides `search_by_content` to search inside file contents, which can expose sensitive user data from documents or other files. While the function is documented technically, there is no warning, confirmation, or user-facing disclosure that content scanning may inspect private file contents.

Static analysis

No suspicious patterns detected.