web-search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

This web-search skill is mostly purpose-aligned, but it uses stealth browser automation and disables Chromium sandboxing while loading remote pages, which makes it risky enough for manual review.

Review before installing. Use it only in an isolated environment, avoid sensitive or confidential search terms, and prefer removing the stealth plugin and Chromium no-sandbox flags. The publisher should align the documented engine list with the scripts and regenerate dependencies from an approved registry with pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search.js:117

Finding

Chromium Security Sandbox Explicitly Disabled

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/package-lock.json:18

Finding

Dependency Lockfile Relies on a Third-Party npm Registry Mirror

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

整体用途基本一致：代码的核心目的确实是通过无头浏览器访问搜索引擎并返回实时网页搜索结果，因此主功能方向与声明相符。但声明对支持的搜索引擎做了较宽泛且具体的列举，实际代码只配置并调用了 Google、Bing 和夸克AI，未见百度、360、Sogou、微信、今日头条、谷歌以外多数所宣称平台的实现，因此描述对覆盖范围有明显夸大。另外，代码还引入了夸克AI作为回退搜索源，这一具体能力未在声明中提到。虽然这不改变主用途，但属于描述与实际行为之间的实质性偏差。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

该描述与代码片段存在明显不一致。声明称这是一个支持多个具体搜索引擎的无头浏览器搜索技能，但当前提供的代码只是一个演示 shell 脚本，调用 multi-search.js 执行几个固定示例查询。根据脚本可见的实际行为，支持范围主要是 Google、Bing，以及 Google 失败时切换到夸克AI；并没有证据表明支持百度、360、Sogou、微信、今日头条等声明中的引擎。与此同时，代码片段本身也没有展示“无头浏览器”实现。因此，虽然总体主题仍与“搜索”相关，但在支持的引擎范围、实现方式和主要呈现用途上都与声明有实质偏差，应判定为描述不准确。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

整体上，代码的核心用途与声明较接近，都是通过无头浏览器获取实时网络搜索/新闻结果；但描述存在明显实现不一致。声明列出的部分关键搜索源（微信、谷歌）在代码中根本不存在，而代码又实现了若干未声明的搜索源，以及对财经新闻网站的直接抓取功能，这不再只是“通过搜索引擎搜索”。因此应判定为描述与实际行为存在实质性不匹配，虽然主功能方向相近。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

使用 `multi-search.js` 脚本可以同时搜索 **Google** 和 **Bing**，进行对照验证：

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 82% confidence

Finding

brace-expansion 1.1.12 is flagged with multiple denial-of-service advisories involving pathological brace patterns that can trigger excessive CPU, hangs, or memory exhaustion. Although this package is transitive and not obviously exposed directly by the skill, vulnerable dependency chains still matter because any reachable glob or pattern processing path could be abused to degrade availability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill deliberately enables a stealth/anti-bot evasion plugin before performing browser automation. In a search utility, this bypass behavior increases risk because it conceals automation from remote sites, can violate site protections or policy controls, and makes the skill more suitable for covert scraping than ordinary user-directed search.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends user queries to third-party search engines through a headless browser, but the description does not clearly warn users that their input will be transmitted externally. In a search skill handling news, finance, or potentially sensitive topics, this creates a meaningful privacy and consent risk because users may disclose confidential or identifying queries unknowingly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language description forces a specific language/locale presentation rather than offering the user an opt-in or noting that the skill is intended only for a Chinese-speaking context. Under the policy, fixed language behavior without user choice or justification is a reportable locale-policy issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The documentation instructs users to run npx playwright, which can fetch and execute the latest package version at install time rather than a pinned, reviewed version. In a skill context that automates web access, this increases supply-chain risk because a compromised or breaking upstream release could change behavior or execute unexpected code on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script sends user-supplied search terms to third-party search engines, which can disclose sensitive queries, internal project names, credentials accidentally pasted by users, or other private information to external providers. In this skill context, that risk is more meaningful because the tool is specifically designed to perform live web searches, but it lacks any explicit consent flow, warning, or filtering for sensitive data before transmission.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The dependency set includes puppeteer-extra-plugin-stealth, and its transitive plugins add browser fingerprint evasion plus profile/user-data-dir handling that exceed a straightforward search capability. In the context of a web-search skill, this expands the tool from normal browsing into anti-detection automation and local browser state management, increasing abuse potential for scraping restrictions bypass, persistent tracking state, or unintended local data exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest says the skill supports engines including 百度、360、Sogou、微信、今日头条、谷歌等, implying broad multi-engine support. In this script's documentation and examples, the behavior is described as Google+Bing by default with Quark AI fallback and single-engine flags for google/bing/quark, which actively presents a narrower and different engine set than the manifest claims.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code contains natural-language comments and CLI output exclusively in Chinese, such as the Stealth plugin comment and all usage/error messages, without any opt-in or alternative locale support. Under the policy, forcing a specific language is a violation unless the locale restriction is explicitly justified or optional.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a web-search skill supporting engines such as WeChat, Toutiao, and Google, but the implemented engine list lacks WeChat and Google while adding DuckDuckGo, Brave, and Yahoo. It also introduces direct scraping of finance news sites as selectable sources, which is a broader behavior than the manifest's stated multi-engine search support.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file header documents the script as a comparative search tool that searches Google and Bing, with Quark only as a substitute if Google fails. However, the main logic includes explicit Quark-only mode and can run Quark independently via command-line options, which goes beyond the stated intent in the comment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language strings throughout the file, including comments, usage text, and runtime messages, are in Chinese only. The file does not provide user opt-in for language selection or justify a locale-specific restriction, which can violate language/locale policy guidance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says the skill supports Baidu, Bing, 360, Sogou, WeChat, Toutiao, Google, and other domestic/foreign engines. In this file, the SEARCH_ENGINES configuration defines only three engines: Google, Bing, and Quark, so the implemented behavior is materially narrower than the stated capability.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency uses a caret range (^1.58.2), which permits automatic installation of newer minor/patch releases rather than a single audited version. In a browser-automation skill that fetches live web content, supply-chain risk is more relevant because compromised or breaking dependency updates could affect networked execution paths and browser control behavior.

Content

Scanner excerpt · scripts/package.json (reported line 13)May include surrounding context.

json

"license": "ISC",
  "description": "",
  "dependencies": {
    "playwright": "^1.58.2",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency range (^3.1.2) is not fully pinned, so builds may resolve to different package contents over time. Because this skill relies on browser automation and search across external sites, an unexpected upstream update in playwright-extra could introduce malicious code, instability, or altered stealth/network behavior.

Content

Scanner excerpt · scripts/package.json (reported line 14)May include surrounding context.

json

"description": "",
  "dependencies": {
    "playwright": "^1.58.2",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The stealth plugin is referenced with a caret range (^2.11.2), allowing unreviewed upstream changes to be pulled in. This is somewhat more sensitive than a typical library because stealth/evasion plugins modify browser fingerprinting and request behavior, so a compromised or unsafe update could materially affect browsing actions, data exposure, or policy compliance.

Content

Scanner excerpt · scripts/package.json (reported line 15)May include surrounding context.

json

"dependencies": {
    "playwright": "^1.58.2",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing comments and console output are entirely in Chinese, including usage guidance and example descriptions. For a general-purpose example script, this imposes a language choice without opt-in or any indication that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.