Yves Web Search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:19 PM UTC
• Version: 1.0.1

Overview

This is a straightforward web-search skill, with some privacy and dependency cautions but no evidence of hidden, destructive, or deceptive behavior.

Installers should treat this as a benign web-search helper, but users should know that search terms and fetched URLs go to third-party services. Avoid sensitive prompts, private hostnames, signed URLs, or secrets, and pin/review the optional ddgs dependency before installing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:88

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:88-92 and scripts/search.py:18-22
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:88-92:

markdown

If web_fetch is blocked, use Python's `ddgs` package:

```bash
pip install ddgs

text

`scripts/search.py:18-22`:

```python
try:
    from ddgs import DDGS
except ImportError:
    print("Error: ddgs not installed. Run: pip install ddgs", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The Skill instructs users to install ddgs from the default Python package index without specifying an exact version, verifying a cryptographic hash, or using a reviewed lock file. The bundled script repeats the same unpinned installation recommendation when the dependency is unavailable.

Package installation may execute package-controlled build or installation logic. Consequently, the effective code installed by this instruction can change after the Skill has been reviewed. A compromised package release, compromised package-distribution account, or malicious replacement obtained through an unsafe package-index configuration could introduce arbitrary code.

The legitimate web-search functionality requires a search provider or library, but it does not require accepting an unspecified future version of that dependency. The dependency behavior therefore exceeds the minimum safely defined trust boundary.

Attack Path

1. An attacker compromises the ddgs distribution channel, maintainer account, or a package index configured in the user's environment.
2. The attacker publishes a malicious release or serves an attacker-controlled package under the expected name.
3. A user follows the documented fallback instruction or the error message and runs pip install ddgs.
4. Pip resolves the dependency without a version or hash constraint.
5. Package-controlled installation or runt ...[truncated 790 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin ddgs to a specifically reviewed version instead of installing the latest available release:

   bash

   python -m pip install "ddgs==REVIEWED_VERSION"
   

2. Record cryptographic hashes in a dependency file and require verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate and commit a lock file containing resolved transitive dependencies and hashes.
4. Configure installation to use an explicitly trusted package index and disable unintended extra indexes where feasible.
5. Install the dependency inside an isolated virtual environment without administrator privileges.
6. Review the pinned package and its transitive dependencies before updating the lock file.
7. Replace the unpinned installation command in both SKILL.md and the scripts/search.py error message with the secured installation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description is extremely broad ('look up information, find answers, or search for anything online'), which can cause this skill to be invoked for a wide range of ordinary user requests. In an agent environment, overbroad matching increases the chance of unnecessary external web access and accidental disclosure of user prompts or sensitive context to remote services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to send user queries and target URLs to third-party services such as Jina AI and DuckDuckGo without any privacy warning, consent check, or data-handling guidance. This is dangerous because user prompts, embedded secrets, internal URLs, or sensitive research targets could be transmitted to external providers and logged outside the user's control.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comments and usage text describe ground mode as fact-checking a provided statement, and line L107 rewrites TARGET into a statement=... parameter. However, the request is later made to $BASE_URL only, and TARGET is never appended, so the code does not actually send the statement it claims to fact-check.

Content

No source excerpt is available for this finding.