Infoseek V141 Clean

• Outcome: Review
• Latest audit: Aug 30, 2026 · 5:25 AM UTC
• Version: 1.4.1

Overview

The skill is a real research tool, but it also includes broad credential, server, cross-skill execution, and file-management powers that need review before installation.

Install only if you need a full research platform and are comfortable granting it local persistence, network access, and credential-management authority. Prefer a venv install, avoid remote SSE unless you set strong tokens and remove the default OAuth client/secret, do not store broad default credentials for fetching, and review or disable manage_keys, qcm_query, identity attribution, keyring persistence, and delete-to-recycle before use.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (99)

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

requires_consent,
    )
except ImportError:  # 直接运行时兜底
    sys.path.insert(0, str(__import__("pathlib").Path(__file__).parent.parent / "core"))
    from capability_errors import CapabilityError, ConsentRequired, CapabilityUnavailable
    from capability_registry import (
        get_capability, grant_consent, is_effective_enabled, is_enabled,

• Confidence: 76% confidence
• Finding: The fallback path mutates sys.path at runtime and then imports capability modules from that newly inserted directory. If an attacker can influence the package layout, working tree, or deployed filesystem near this script, they may be able to cause the process to import unintended Python code, leading to arbitrary code execution in the application context.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill advertises substantial capabilities including environment-variable access, file read/write, network access, and shell execution, yet declares no permissions. This creates a transparency and consent failure: a host or user may invoke the skill without realizing it can exfiltrate data, modify local files, or execute commands, which materially increases abuse risk in an agent environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is research/content collection, but the described behavior extends into key lifecycle management, auth/RBAC, server hosting, GraphQL/subscriptions, external reverse-calls, identity attribution, leak scanning, and installation workflows. This scope expansion is dangerous because it hides materially different trust boundaries and privileged behaviors behind a benign-looking research label, increasing the chance of unsafe deployment or overbroad invocation.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module persists extracted claims across sessions via a local claim store, which expands behavior from transient conflict detection into ongoing data retention. In a research/collection skill that processes source text and URLs at scale, this can silently accumulate potentially sensitive or proprietary content metadata without clear minimization, retention, or consent controls.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The comments state the additions do not affect semantics, but the implementation adds cross-session augmentation and severity escalation, changing outputs and trust signals. This is dangerous because downstream systems or users may rely on documented behavior and make decisions based on silently altered risk scoring or historical correlation they did not expect.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The function is documented and named as a pure extraction routine, but it performs an additional side effect by recording detected entities through EntityTracker. In a content-intelligence workflow, this can create unexpected data persistence, leak sensitive entities from processed text, and violate caller assumptions about privacy, auditability, or deterministic behavior.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The document claims credentials are not saved to disk, yet the same KeyManager description says usage data is persisted to `~/.infoseek/key_usage.json`. Even if raw keys are not written, persistent per-provider usage/fingerprint metadata can still expose sensitive operational details and directly contradicts the stated SESSION_ONLY policy, increasing the risk of credential mishandling and unsafe integrator assumptions.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The stated security intent of 'do not save credentials' conflicts with the described persistent lifecycle, quota tracking, and usage-record behavior. This kind of documentation/behavior mismatch is dangerous because downstream users or host integrations may trust the safer claim and deploy the tool in environments where any credential persistence or durable metadata is prohibited.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The document presents the skill as fully provided and aligned, yet later admits that deep-fetch levels L2-L4 are still only stubs. In a research/collection workflow, this can mislead operators or downstream agents into assuming stronger collection and fallback coverage than actually exists, causing incomplete evidence gathering, incorrect trust in results, or unsafe operational decisions.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The documentation claims full alignment and completeness while simultaneously disclosing gaps in important functionality, creating a reliability and trust-boundary problem. Although this is not direct code execution, in a security-sensitive intelligence-gathering skill it can cause users to overestimate coverage, weakening review and compensating controls.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: This file implements standalone social-account human/bot/astroturf classification, which goes beyond a typical content collection or research workflow and enables profiling of individuals or accounts. In the context of an infosec/content-intelligence skill, this increases the risk of misuse for surveillance, targeting, or unsupported identity inference, especially because the heuristic labels may be treated as authoritative despite being low-assurance.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The deprecated wrapper promises behavior compatibility, but on ImportError it silently returns a fabricated score derived from source.get('score', 50) and labels it as '🟡潜力'. In a research and source-gating workflow, this can misclassify low-quality or untrusted inputs as acceptable, weakening downstream filtering and potentially contaminating reports or archival decisions without any obvious failure signal.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The built-in default client is effectively a hardcoded credential, and issued tokens always receive tenant=admin with admin=True, causing all scope and tool checks to succeed. In a content-research skill, this creates an unnecessary privileged backdoor: anyone with the default credentials can mint admin tokens and bypass RBAC entirely.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The `research()` API is presented as an analysis/reporting workflow, but it also performs persistent side effects by extracting candidates and queuing entity suggestions into a pending knowledge-base review path. Hidden writes and state changes violate least surprise and can cause unintended retention or cross-session contamination of user-provided or scraped content.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The helper exposes generic delete and restore operations that accept arbitrary filesystem paths and are not constrained to the skill’s archive/state directories. In a research/archive skill, this unnecessarily broad file-management capability increases the blast radius: if an agent or caller passes an unintended path, unrelated user files can be moved or restored, causing data loss, tampering, or recovery into unexpected locations.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring states deletion is '不可绕过' ('cannot be bypassed'), but the implementation of delete-to-recycle directly accepts any provided path and only requires a --yes flag. This mismatch can mislead reviewers or downstream agents into trusting the safety boundary, while in reality the script can operate on arbitrary files outside archive scope.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This CLI introduces credential management, encrypted persistence, backup/restore, and keyring integration that are materially broader than the declared research/content-collection scope. Scope expansion itself is risky because it increases secret-handling exposure and creates new ways for API keys to be stored, copied, and recovered, especially in an agent skill where operators may not expect credential-management behavior.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The export and backup commands extend 'optional auto-archive' into broader file export and secret-store copying behavior, including copying the encrypted data file and its corresponding key file. That combination can defeat the practical protection of encryption because both materials needed for recovery may be duplicated to arbitrary locations chosen by the user.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring states that add is session-local by default, but cmd_add always attempts to persist keys to disk via save_keys. This mismatch can cause users to expose credentials persistently when they believed the action was ephemeral, undermining informed consent and increasing the chance of secret leakage from local storage or backups.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The server exposes secret-management operations (`manage_keys`, `key_usage`) that go beyond the manifest’s stated research/content-collection purpose. In a plugin or agent environment, this expands the attack surface significantly: a caller who can access the server may enumerate providers, inspect usage metadata, rotate keys, or revoke credentials, potentially disrupting service or aiding follow-on attacks against external integrations.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The file conditionally adds OAuth token issuance support via `AuthManager`/`SecretCipher`, which is not reflected in the described Infoseek workflow. Hidden authentication and token-issuing features are security-relevant because they introduce credential-handling paths and trust boundaries that users and integrators may not expect, increasing the risk of misuse, misconfiguration, or accidental exposure.

Description-Behavior Mismatch

Medium

• Confidence: 77% confidence
• Finding: The `qcm_query` cross-skill integration extends the server into a separate crisis/quality-management domain not described in the skill metadata. Undisclosed cross-skill routing can leak data across trust boundaries, trigger unexpected external processing, or give an attacker a way to pivot into additional capabilities that operators did not intend to expose.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest says browser automation crawling is out of scope, but the code includes opt-in scraping of unofficial web interfaces for AI search products. This mismatch increases the risk of undisclosed data transmission, brittle scraping behavior, and collection against services whose interfaces or terms may not permit automated access.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill is described as content collection and research, but this code adds identity attribution across external accounts using username correlation tools. That is a materially different capability with privacy and misuse implications, especially because it can expand a single identifier into a cross-platform profile of a person.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Username-based identity attribution is not necessary for the stated research workflow and can be used to correlate accounts across platforms without the subject's knowledge. Even with an environment flag and registry checks, the capability meaningfully raises privacy, doxxing, and surveillance risk beyond normal content gathering.

Static analysis

No suspicious patterns detected.