Privacy Search

• Outcome: Review
• Latest audit: Jul 19, 2026 · 3:55 AM UTC
• Version: 1.1.0

Overview

This privacy search skill mostly matches its purpose, but its strict privacy mode can automatically send searches to lower-privacy engines and its install/update paths need closer review.

Review this before installing, especially if searches may be sensitive. Prefer explicitly selecting trusted engines such as local SearXNG and disable update checks if metadata disclosure matters. Avoid the pip/Docker latest SearXNG paths unless you are comfortable with that supply-chain risk, and ask the publisher to remove automatic Baidu/Bing fallback from strict mode or make it opt-in.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

python_path = self._ensure_venv()
            pip_path = os.path.join(self.venv_path, "bin", "pip.exe") if os.name == "nt" else os.path.join(self.venv_path, "bin", "pip")
            print(f"📥 安装 SearXNG 到 {self.venv_path}")
            subprocess.run([pip_path, "install", "searxng"], check=True, timeout=120)
            return True
        except Exception as e:
            print(f"❌ 安装失败: {e}")

• Confidence: 85% confidence
• Finding: subprocess.run([pip_path, "install", "searxng"], check=True, timeout=120)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return False

            # 启动服务
            self.server_process = subprocess.Popen(
                [python_path, "-m", "searxng"],
                env={
                    **os.environ,

• Confidence: 81% confidence
• Finding: self.server_process = subprocess.Popen( [python_path, "-m", "searxng"], env={ **os.environ, "SEARXNG_BIND_ADDRESS":

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and instructs use of scripts that perform network access, shell-adjacent operations, file reads/writes, environment use, and optional Docker/pip setup, yet the manifest shown in SKILL.md declares only name/description/version and no explicit permissions. This creates a transparency and trust problem: users and hosting platforms cannot accurately assess or constrain the skill's capabilities, increasing the risk of over-privileged execution or unexpected side effects during installation, updates, and local service management.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The document describes Yandex and Startpage as '离线后备', but they are external search engines that require outbound network requests and disclose the user's query to third parties. This can mislead users into believing their searches remain local or offline, weakening informed consent around privacy-sensitive behavior.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring states that strict mode only allows DuckDuckGo and local SearXNG, but the actual default strict_allowed_engines also includes external engines such as Yandex, Startpage, Qwant, and Brave. This creates a security/privacy mismatch: users may rely on strict mode for stronger privacy guarantees than the code actually enforces, causing unintended disclosure of search queries to third parties.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The privacy report explicitly claims that strict mode uses only DuckDuckGo and local SearXNG, while the code may allow several additional external search engines. This is dangerous because the report is a trust signal presented to users, and a false assurance can lead operators to expose sensitive searches to remote providers while believing they are using a narrowly restricted privacy mode.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: In `strict` privacy mode, the code silently falls back to Baidu and Bing when privacy-preserving engines fail. This violates the user's reasonable expectation that `strict` mode will not send queries to lower-privacy providers, and can disclose sensitive search terms to third parties without explicit consent.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation/comments describe `strict` mode as prioritizing privacy-compatible domestic engines and automatic fallback, but the implemented behavior later includes fallback to lower-privacy engines. This mismatch is security-relevant because users may choose `strict` mode specifically for sensitive searches and be misled about where their data is sent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The '最佳速度' recommendation promotes Baidu/Bing for performance but does not clearly and prominently warn that these engines provide weaker privacy protections and may collect more user data. In a privacy-focused skill, this mismatch can cause users to unintentionally expose sensitive search terms under the impression they are following a recommended mode.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends user queries over the network to multiple external search engines, which can expose sensitive search terms, IP metadata, and timing information to third parties. Because this is a privacy-search tool, lack of explicit user-facing disclosure and consent makes the risk more significant in context.

External Transmission

Medium

• Category: Data Exfiltration

Content

CURRENT_VERSION = "1.0.0"
SKILL_SLUG = "privacy-search"
UPDATE_CHECK_URL = "https://api.skillhub.cn/api/v1/skills/privacy-search"
GITHUB_UPDATE_URL = "https://api.github.com/repos/your-org/privacy-search/releases/latest"
CACHE_DB_PATH = os.path.expanduser("~/.workbuddy/output/.privacy-search-update.db")

• Confidence: 82% confidence
• Finding: https://api.skillhub.cn/

External Transmission

Medium

• Category: Data Exfiltration

Content

CURRENT_VERSION = "1.0.0"
SKILL_SLUG = "privacy-search"
UPDATE_CHECK_URL = "https://api.skillhub.cn/api/v1/skills/privacy-search"
GITHUB_UPDATE_URL = "https://api.github.com/repos/your-org/privacy-search/releases/latest"
CACHE_DB_PATH = os.path.expanduser("~/.workbuddy/output/.privacy-search-update.db")

• Confidence: 81% confidence
• Finding: https://api.github.com/

Known Vulnerable Dependency: aiohttp==3.9.0 — 10 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: aiohttp==3.9.0

Known Vulnerable Dependency: lxml==5.0.0 — 2 advisory(ies): CVE-2026-41066 (lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to); CVE-2026-41066 (lxml is a library for processing XML and HTML in the Python language. Prior to 6)

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: lxml==5.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.