Handy01 Multi Search Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:46 AM UTC
• Version: 2.1.5

Overview

The skill is a coherent multi-search tool, but it misleadingly says there is no external data transmission while sending queries to multiple third-party search engines.

Install only if you are comfortable with your search queries being sent to selected third-party search engines, potentially multiple providers per request. Do not use it for passwords, API keys, private source code, internal URLs, regulated data, or confidential business searches unless the skill is updated to make provider selection explicit and correct its privacy notice.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14

Finding

Undisclosed Multi-Provider Transmission of Potentially Sensitive Search Queries

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

ription: "Multi search engine integration with 16 engines (7 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and WolframAlpha knowledge queries. No API keys required."
---

# Multi Search Engine

Integration of 16 search engines for web crawling without API keys.

## Workflow

1. **Preparation**: AI Agent initializes an empty in-memory cookie store. Cookies are only acquired dynamically during search operations when access is denied

2. **Language Evaluation**: Detect the language attribute of the search query. If the query is in Chinese, use Domestic search engines (Baidu, Bing CN, Bing INT, 360, Sogou, WeChat, Shenma). If the query is non-Chinese, use International search engines (Google, Google HK, DuckDuckGo, Yahoo, Startpage, Brave, Ecosia, Qwant, WolframAlpha). Select engines based on query relevance and availability.

3. **Controlled Search**: Use web_fetch to execute search requests with rate limiting:
   - Add 1-2 second delay be

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents the skill's descriptive and instructional content in Chinese, including section headings, feature descriptions, and usage notes. This can violate a language/locale policy when the skill forces a specific language without giving users an explicit choice or documenting that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatically routing queries based on detected language to domestic or international engines can silently send user data to jurisdictions or providers the user did not choose. This is especially risky for sensitive searches because the user is not given meaningful control over destination, privacy posture, or legal exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims 'All operations run locally, no external data transmission' even though its core function is to send user queries to multiple third-party search engines via web requests. This is a materially misleading privacy statement that can cause users to disclose sensitive queries under false assumptions, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The configuration hard-codes China-specific search endpoints and locale behavior, including CN-region engines and Bing CN settings, without any visible user choice or opt-in. This can route user queries through region-specific providers and jurisdictions with different censorship, monitoring, and privacy characteristics, creating an avoidable privacy and integrity risk for users who may expect neutral or globally selected search behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents its guidance exclusively in Chinese from the title onward, with no indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless clearly justified as region-specific, which is not stated here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guide promotes using cached pages to view deleted content without any caution about privacy, consent, or sensitivity of removed material. This can encourage retrieval of content that was intentionally taken down, potentially exposing personal, confidential, or outdated information users should not casually access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Startpage example explicitly documents nj=0 to disable family filtering, but provides no warning that this can expose users to adult, explicit, or otherwise unsafe content. In a reusable search skill, users may copy parameters directly, so normalizing unsafe-search bypasses increases the chance of unintended exposure, especially for minors or workplace/school contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The guide defaults to a single language and includes examples centered on Chinese locale settings such as lr=lang_zh-CN, cr=countryCN, and kl=cn, with no opt-in or alternative language guidance. SQP-3 covers natural-language policy issues where a skill effectively forces a specific language or locale without user choice.

Content

No source excerpt is available for this finding.