privacy-search

• Outcome: Review
• Latest audit: Aug 24, 2026 · 2:24 PM UTC
• Version: 1.7.0

Overview

The skill is a coherent privacy-search tool, but it needs Review because sensitive search queries and page content can leave the machine, local history is stored by default, and setup/update features broaden host and network impact.

Review this before installing if you handle sensitive searches. Use strict mode, disable cache/history and startup update checks if needed, avoid MCP synthesize without explicit privacy controls, do not configure the external LLM API key for confidential work, and run SearXNG setup only if you accept Docker/pip host changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

python_path = self._ensure_venv()
            pip_path = os.path.join(self.venv_path, "bin", "pip.exe") if os.name == "nt" else os.path.join(self.venv_path, "bin", "pip")
            print(f"📥 安装 SearXNG 到 {self.venv_path}")
            subprocess.run([pip_path, "install", "searxng"], check=True, timeout=120)
            return True
        except Exception as e:
            print(f"❌ 安装失败: {e}")

• Confidence: 84% confidence
• Finding: The code installs the unpinned package "searxng" from the package index at runtime, which creates a software supply-chain risk. An attacker controlling dependency resolution, a compromised package, or a hostile index/proxy could cause arbitrary code execution on the host during installation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and documents significant capabilities including shell execution, network access, file read/write, environment-dependent configuration, and long-running service exposure via an MCP server, but the metadata shown in this file does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a host or reviewer may underestimate what the skill can do, increasing the chance of unsafe installation or execution in a broader-trust environment.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The example claims the query is 'completely local' while explicitly configuring Yandex and Startpage as fallback/search engines, which would send the user's query to external services. In a privacy-focused skill, this is a materially misleading statement that can cause users or downstream agents to make incorrect trust decisions and unintentionally leak sensitive search terms.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: A search-related skill is also able to pull images, create containers, and manage host-level Docker state, which materially exceeds core search functionality. In an agent context, this broadens the blast radius significantly: if invoked unexpectedly, it can modify the host, fetch untrusted images, and introduce persistent services.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The module executes host-level subprocesses for Docker and package-management tasks, which is a dangerous capability escalation for a skill that appears to provide search. Even without classic injection, agent-exposed subprocess execution can be abused indirectly to alter the local environment or install additional software.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The module performs outbound connections to SkillHub and GitHub for update checks, which is unrelated to a specific user search query and broadens the skill's data exposure surface. Even though the requests appear limited to version metadata, automatic background network traffic can leak IP address, timing, User-Agent, and tool usage to third parties without being necessary for the primary search task.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The quick-start section encourages immediate use of the search tool without prominently disclosing that queries, cache entries, and history are stored locally. In a privacy-focused skill, this can mislead users into assuming stronger local privacy guarantees than actually provided, especially on shared or monitored devices.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The schema documents tools that send user queries to multiple external search engines and fetch arbitrary URLs, but it does not explicitly warn integrators that user input and requested URLs will be transmitted to third-party services. In an agent/MCP context, downstream skill authors may invoke these tools automatically, causing unintended disclosure of sensitive prompts, internal identifiers, or private URLs to external providers.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This module persists search queries, engine selections, privacy mode, result metadata, and history timestamps to a predictable local SQLite file under the user's home directory. In a privacy-focused search skill, silently retaining this data materially increases privacy risk because sensitive queries may remain on disk without clear user consent, visibility, or an easy opt-in disclosure at the point of collection.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The comments and implementation describe randomized browser fingerprints specifically to reduce bot detection, which indicates deliberate anti-detection behavior when querying third-party services. In an agent skill that performs automated multi-engine scraping/search, this increases legal, policy, and abuse risk and can facilitate stealthy mass collection against sites that might otherwise rate-limit or block automation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The code hard-codes `Accept-Language` to `zh-CN,zh;q=0.9,en;q=0.8` for all outbound HTTP requests, which can reveal a strong regional/language preference without user consent and undermines the skill's stated privacy goals. In a privacy-focused search skill, forcing a stable locale increases fingerprintability and may influence localized search results, making user behavior more identifiable across engines.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When an API key is configured, the code sends the raw user query plus aggregated search-result content to a third-party LLM service. In a privacy-focused search skill, this creates a real confidentiality risk because user searches may contain sensitive personal, organizational, or investigative data, and the code shows no consent gate, redaction, or explicit privacy control at the transmission point.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends both the user query and fetched third-party page content to an external LLM provider whenever an API key is configured, but this file contains no consent gate, disclosure, redaction, or policy enforcement before export. In a privacy-focused search skill, that behavior materially increases risk because sensitive queries or scraped content may be transmitted off-box unexpectedly, undermining the stated privacy posture and potentially exposing personal or confidential data to the provider.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The startup update-check path can automatically send HTTP requests to external services with no user-facing disclosure at the moment the transmission occurs. In a privacy-oriented skill, silent outbound communication is especially risky because it undermines user expectations and can reveal environment metadata such as IP address, timing, and installation presence.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 从 SKILL.md 动态读取，避免版本漂移
CURRENT_VERSION = get_current_version()
SKILL_SLUG = "privacy-search"
UPDATE_CHECK_URL = "https://api.skillhub.cn/api/v1/skills/privacy-search"
GITHUB_UPDATE_URL = "https://api.github.com/repos/njskills/privacy-search/releases/latest"
CACHE_DB_PATH = os.path.expanduser("~/.workbuddy/output/.privacy-search-update.db")

• Confidence: 88% confidence
• Finding: The hard-coded SkillHub API endpoint is used for remote update checks, creating an external transmission channel outside the skill's core search workflow. Even limited metadata requests expose the user's IP address and usage patterns to a third party, which is more concerning given the skill's privacy-focused positioning.

External Transmission

Medium

• Category: Data Exfiltration

Content

CURRENT_VERSION = get_current_version()
SKILL_SLUG = "privacy-search"
UPDATE_CHECK_URL = "https://api.skillhub.cn/api/v1/skills/privacy-search"
GITHUB_UPDATE_URL = "https://api.github.com/repos/njskills/privacy-search/releases/latest"
CACHE_DB_PATH = os.path.expanduser("~/.workbuddy/output/.privacy-search-update.db")

• Confidence: 88% confidence
• Finding: The GitHub Releases API endpoint is another external transmission destination used for fallback update checks. This increases third-party visibility into tool usage and creates additional privacy exposure inconsistent with a privacy-first expectation when done automatically.

Known Vulnerable Dependency: aiohttp==3.9.0 — 10 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The requirement range permits installation of aiohttp 3.9.0, and the finding specifically identifies that version as carrying multiple known high-severity advisories. In this skill, aiohttp is likely central to outbound HTTP fetching, cookie handling, multipart processing, and proxy/retry behavior, so vulnerable versions increase risk in a network-facing component that processes untrusted remote content.

Known Vulnerable Dependency: lxml==5.0.0 — 2 advisory(ies): CVE-2026-41066 (lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to); CVE-2026-41066 (lxml is a library for processing XML and HTML in the Python language. Prior to 6)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The requirement range permits installation of lxml 5.0.0, which is reported as vulnerable to XXE-related issues in certain parser configurations. Because this skill fetches and parses remote web content from many external engines and pages, an unsafe XML/HTML parsing path could expose the agent environment to maliciously crafted documents or SSRF/file disclosure behavior depending on usage.

Static analysis

No suspicious patterns detected.