Multi Search Engine

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:34 AM UTC
• Version: 2.1.3

Overview

The skill is a real multi-search helper, but its privacy notice falsely says there is no external data transmission even though searches are sent to third-party engines.

Review this before installing if you may search for private, internal, regulated, or identifying information. The skill will send search terms to third-party search engines despite saying there is no external transmission. Avoid using it for secrets, credentials, private customer data, incident details, or confidential project names unless that disclosure is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

ription: "Multi search engine integration with 16 engines (7 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and WolframAlpha knowledge queries. No API keys required."
---

# Multi Search Engine

Integration of 16 search engines for web crawling without API keys.

## Workflow

1. **Preparation**: AI Agent initializes an empty in-memory cookie store. Cookies are only acquired dynamically during search operations when access is denied

2. **Language Evaluation**: Detect the language attribute of the search query. If the query is in Chinese, use Domestic search engines (Baidu, Bing CN, Bing INT, 360, Sogou, WeChat, Shenma). If the query is non-Chinese, use International search engines (Google, Google HK, DuckDuckGo, Yahoo, Startpage, Brave, Ecosia, Qwant, WolframAlpha). Select engines based on query relevance and availability.

3. **Controlled Search**: Use web_fetch to execute search requests with rate limiting:
   - Add 1-2 second delay be

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The natural-language claim that no external data transmission occurs is directly contradicted by the skill's core behavior of querying remote search engines. Misleading documentation about network egress is especially dangerous in an agent skill because automated systems may select or approve it for privacy-sensitive tasks based on that incorrect statement.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation claims 'All operations run locally, no external data transmission,' but the skill explicitly sends user queries and request metadata to external search engines via web requests. This is dangerous because users or downstream agents may rely on the false privacy claim and submit sensitive data under the mistaken belief that nothing leaves the local environment.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The natural-language documentation for the skill's metadata, features, and changelog is presented in Chinese only. Under the language policy rule, forcing a specific language without offering a choice or documenting a justified locale constraint is a policy violation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Stating that the tool does not collect or transmit personal information is misleading because user-entered search queries are sent to third-party providers and may themselves contain personal or sensitive data. This can cause accidental privacy leaks if users assume their input will remain local or unshared.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill lacks an accurate warning that search terms are sent to third-party search engines, despite presenting privacy-oriented assurances nearby. In this context, omission of that disclosure increases the chance that sensitive organizational or personal information will be entered into queries and exposed externally.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The config includes locale-specific search services such as 'Bing CN' and marks them with region 'cn', indicating a forced regional variant rather than a user-selectable locale. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern, and the file provides no indication that users can choose or override this behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide repeatedly instructs use of web_fetch against third-party search engines and knowledge services without warning that user queries, metadata, and potentially sensitive terms will be transmitted to external providers. In a skill context, this can cause inadvertent privacy leakage, especially if users search for internal project names, credentials, incident terms, or regulated data.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The manifest describes a multi-search-engine skill focused on search integration, advanced operators, filters, privacy engines, and WolframAlpha knowledge queries. This document also promotes password generation, UUID generation, Base64 encode/decode, QR-code generation, and URL shortening through DuckDuckGo query features, which are utility-generation capabilities rather than search behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly shows parameters that disable safe/family filtering without any warning about exposure to adult, graphic, abusive, or otherwise unsafe content. In an agent skill, this increases the chance that downstream users or automations retrieve inappropriate material unintentionally, including in environments with minors or workplace compliance requirements.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The sample calls demonstrate using DuckDuckGo to generate passwords, perform Base64 encoding, convert colors, and generate QR codes. Those capabilities are not justified by the manifest's stated purpose of integrating multiple search engines for search queries and knowledge lookup.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The documentation explicitly encourages use of external search engines via direct web requests but does not warn that user queries will be transmitted to third-party services such as Google, DuckDuckGo, and WolframAlpha. This can expose sensitive prompts, internal terms, or user data to external providers, especially in an agent setting where users may not realize their input leaves the local environment.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The file's natural-language content is fully Chinese and does not indicate that the language is optional or limited to a specific region or audience. Under the policy, forcing a specific language without user opt-in can be a locale-policy concern unless the restriction is clearly documented and justified.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This markdown file contains multiple `web_fetch` examples that send user-supplied search terms to external search engines such as Baidu, Bing, Sogou, and Shenma. The document does not warn that queries may be transmitted to third parties and could expose user interests or sensitive terms.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: A language or locale policy issue can arise when a skill effectively forces one language without opt-in or explanation. This file presents all instructions exclusively in Chinese and does not indicate that the skill is intentionally region-specific or provide an alternative language option.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: Promoting access to cached or deleted content without a warning can encourage retrieval of material the publisher intended to remove, including outdated, sensitive, or privacy-impacting information. Although the feature is publicly accessible, presenting it as a convenience in an agent skill lowers friction for potentially inappropriate use.

Static analysis

No suspicious patterns detected.