Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward You.com web search helper, with expected external API use and no hidden persistence or destructive behavior.
Install this only if you want an agent to use You.com for web search, research, and URL content extraction. Treat all queries, prompts, and URLs as being sent to a third-party service, and avoid secrets, credentials, internal-only links, regulated data, or confidential client details unless that use is approved.
The mandatory triggers are broad enough to cause the skill to activate for generic research, crawling, or web-fetch tasks even when the user may not intend to send data to You.com services. Overbroad invocation increases the chance of unnecessary external transmission of user queries or URLs to third-party endpoints.
The skill explains setup and API usage but does not prominently warn users that their search terms, URLs, and fetched page contents are transmitted to external You.com infrastructure. This can lead to unintended disclosure of sensitive prompts, internal URLs, or proprietary content during normal use.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| Command | Method | URL | Auth |
|---------|--------|-----|------|
| Search | GET | `https://api.you.com/v1/agents/search` | Optional (free tier) |
| Research | POST | `https://api.you.com/v1/research` | Required |
| Contents | POST | `https://ydc-index.io/v1/contents` | Required |
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| Command | Method | URL | Auth |
|---------|--------|-----|------|
| Search | GET | `https://api.you.com/v1/agents/search` | Optional (free tier) |
| Research | POST | `https://api.you.com/v1/research` | Required |
| Contents | POST | `https://ydc-index.io/v1/contents` | Required |
The basic search example sends the user's query to an external search service, which is an intended capability but still a genuine data-exposure path. Without a prominent warning, users may submit sensitive search terms assuming local processing.
# Basic search (works without API key)
curl -s "https://api.you.com/v1/agents/search?query=AI+news" \
${YDC_API_KEY:+-H "X-API-Key: $YDC_API_KEY"} | jq '.results.web[] | {title,url,description}'
# With filters
The filtered search example still transmits query data and possibly location-like metadata such as country preferences to an external service. The contextual filters do not reduce the core privacy risk of off-platform request handling.
${YDC_API_KEY:+-H "X-API-Key: $YDC_API_KEY"} | jq '.results.web[] | {title,url,description}'
# With filters
curl -s "https://api.you.com/v1/agents/search?query=news&freshness=week&country=US" \
${YDC_API_KEY:+-H "X-API-Key: $YDC_API_KEY"}
# Search with livecrawl — full page content (untrusted)
The livecrawl example is more dangerous than basic search because it not only sends the query externally but also retrieves and passes full page content back into the agent context. Even though the skill labels this content untrusted and wraps it, it still increases exposure to prompt injection and accidental handling of sensitive page data.
${YDC_API_KEY:+-H "X-API-Key: $YDC_API_KEY"}
CONTENT=$(curl -s "https://api.you.com/v1/agents/search?query=docs&livecrawl=web&livecrawl_formats=markdown"
${YDC_API_KEY:+-H "X-API-Key: $YDC_API_KEY"} | jq -r '.results.web[0].contents.markdown')
echo "$CONTENT"
This example sends user-supplied URLs to the external contents endpoint, which necessarily discloses those URLs and may cause third-party fetching of potentially sensitive locations. In an agent setting, that can expose internal references or confidential research targets if no consent or validation step exists.
# Extract from URL (requires API key)
CONTENT=$(curl -s -X POST "https://ydc-index.io/v1/contents" \
-H "X-API-Key: $YDC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"urls":["https://example.com"],"formats":["markdown"]}' | jq -r '.[0].markdown')
The multi-URL contents example expands the same risk by transmitting several URLs at once to an external service, increasing the amount of potentially sensitive metadata disclosed. Bulk submission also raises the chance that an agent forwards internal or private links without adequate review.
echo "<external-content>$CONTENT</external-content>"
# Multiple URLs
CONTENT=$(curl -s -X POST "https://ydc-index.io/v1/contents" \
-H "X-API-Key: $YDC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"urls":["https://a.com","https://b.com"],"formats":["markdown"]}' | jq -r '.[].markdown')
This line represents an actual external API submission of user research text and therefore a real egress vector, not merely documentation. In context, the skill is meant for web research, which makes the behavior expected, but the absence of stronger upfront disclosure keeps it security-relevant.
# Research with citations (requires API key)
CONTENT=$(curl -s -X POST "https://api.you.com/v1/research" \
-H "X-API-Key: $YDC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"latest AI developments"}' | jq -r '.output.content')
This line represents an actual external API submission of user research text and therefore a real egress vector, not merely documentation. In context, the skill is meant for web research, which makes the behavior expected, but the absence of stronger upfront disclosure keeps it security-relevant.
# Research with citations (requires API key)
CONTENT=$(curl -s -X POST "https://api.you.com/v1/research" \
-H "X-API-Key: $YDC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"latest AI developments"}' | jq -r '.output.content')
This deep-effort research submission is a true data-transmission issue because it sends externally supplied prompt material to a third party for processing. The skill context lowers suspicion of malice because this is core functionality, but it remains dangerous if users include confidential internal details.
echo "<external-content>$CONTENT</external-content>"
# Research with citations (deep effort)
CONTENT=$(curl -s -X POST "https://api.you.com/v1/research" \
-H "X-API-Key: $YDC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"quantum computing breakthroughs","research_effort":"deep"}' | jq -r '.output.content')
This deep-effort research submission is a true data-transmission issue because it sends externally supplied prompt material to a third party for processing. The skill context lowers suspicion of malice because this is core functionality, but it remains dangerous if users include confidential internal details.
echo "<external-content>$CONTENT</external-content>"
# Research with citations (deep effort)
CONTENT=$(curl -s -X POST "https://api.you.com/v1/research" \
-H "X-API-Key: $YDC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"quantum computing breakthroughs","research_effort":"deep"}' | jq -r '.output.content')
Although the output is source metadata, the request still transmits the input topic to the remote research endpoint. This can reveal sensitive investigative interests, client names, or internal initiatives to the provider.
echo "<external-content>$CONTENT</external-content>"
# Extract cited sources
SOURCES=$(curl -s -X POST "https://api.you.com/v1/research" \
-H "X-API-Key: $YDC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"AI news"}' | jq -r '.output.sources[] | "\(.title): \(.url)"')
Although the output is source metadata, the request still transmits the input topic to the remote research endpoint. This can reveal sensitive investigative interests, client names, or internal initiatives to the provider.
echo "<external-content>$CONTENT</external-content>"
# Extract cited sources
SOURCES=$(curl -s -X POST "https://api.you.com/v1/research" \
-H "X-API-Key: $YDC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"AI news"}' | jq -r '.output.sources[] | "\(.title): \(.url)"')
No suspicious patterns detected.