Security audit

Global Skills Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed external search helper, with limited privacy and terminal-output risks users should understand.

Install only if you are comfortable sending search terms to the publisher-operated external search API. Do not search for secrets, private project identifiers, customer data, or credentials, and treat displayed search results as untrusted remote content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/search.py:17
Finding: Unsanitized Remote API Data Rendered as Terminal Output
Content: View full analysis
200: desc = desc[:197] + "..." print(f"[{i}] {name}") print(f" Description: {desc}") print(f" Origin: {source}") print("-" * 70) ``` ### Technical Analysis The script retrieves JSON from an externally operated API and directly prints the response's `query`, `name`, `description`, and `source` values without removing terminal control characters. Truncating `description` by character count does not neutralize embedded ANSI, OSC, C0, or C1 control sequences. If the remote API, its backing index, or an indexed skill record is attacker-controlled or compromised, these fields can contain terminal escape ...[truncated 2077 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a script that performs external full-text search and the documentation explicitly states that user queries are forwarded to an external API, but the manifest does not declare any tool scope or permissions for network access. This creates a transparency and policy-enforcement gap: users and hosting systems may not realize the skill can transmit data off-platform, increasing the risk of unintended data disclosure through search queries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script sends the user-supplied search query to a third-party API endpoint without any explicit notice, consent prompt, or local-only alternative. Search terms may contain sensitive internal project names, secrets pasted by mistake, or other private data, so this creates a real privacy and data-exposure risk even though the functionality appears intended.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.