Handy01 Multi Search Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:46 AM UTC
• Version: 2.1.5

Overview

The skill is a coherent multi-search tool, but it misleadingly says there is no external data transmission while sending queries to multiple third-party search engines.

Install only if you are comfortable with your search queries being sent to selected third-party search engines, potentially multiple providers per request. Do not use it for passwords, API keys, private source code, internal URLs, regulated data, or confidential business searches unless the skill is updated to make provider selection explicit and correct its privacy notice.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14
• Finding: Undisclosed Multi-Provider Transmission of Potentially Sensitive Search Queries<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-25` and `SKILL.md:151-153` **Vulnerability Type**: Privacy disclosure caused by insecure documentation and excessive network fan-out **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 2. **Language Evaluation**: Detect the language attribute of the search query. If the query is in Chinese, use Domestic search engines (Baidu, Bing CN, Bing INT, 360, Sogou, WeChat, Shenma). If the query is non-Chinese, use International search engines (Google, Google HK, DuckDuckGo, Yahoo, Startpage, Brave, Ecosia, Qwant, WolframAlpha). Select engines based on query relevance and availability. 3. **Controlled Search**: Use web_fetch to execute search requests with rate limiting: - Add 1-2 second delay between requests to respect server load - Batch requests in groups of 3-4 engines with sequential execution between batches - Include standard browser headers to identify as legitimate user agent - If access is denied (403/429), fetch engine homepage to obtain fresh session cookies 4. **Cookie Management**: - Cookies are stored ONLY in memory during runtime - Cookies are acquired on-demand when search requests fail - No cookies are read from or written to config.json or any file ``` ```markdown ### Data Handling - **No Personal Data**: Tool does not collect or transmit user personal information - **Local Execution**: All operations run locally, no external data transmission - **Session Isolation**: Cookies are session-specific and cleared after use ``` ### Technical Analysis The documented workflow transmits search terms to external search-engine domains through `web_fetch`. It may send the same query to batches of three or four independently operated providers. This directly contradicts the claims that operations are local and that no information is externally transmitted. Search queries can contain personal information, confidential business data, internal hostnames, source- ...[truncated 2212 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the inaccurate claims that all operations are local and that no external data transmission occurs. 2. Clearly state that search queries are transmitted to the selected third-party search providers. 3. Display or document the complete set of potential recipient domains. 4. Default to one search engine and make multi-engine aggregation an explicit opt-in feature. 5. Obtain user confirmation before sending a query to multiple providers. 6. Detect and block or warn about likely secrets, credentials, tokens, personal data, and confidential content before transmission. 7. Advise users not to include passwords, API keys, private source code, internal URLs, or regulated data in search queries. 8. Apply proper URL encoding to all user-supplied query values. 9. Allow users to select an approved provider or restrict searches through an explicit domain allowlist. 10. Minimize cookie acquisition and document precisely which cookie attributes are retained in memory and how redirects are handled. 11. Clarify that privacy-oriented search engines still receive the submitted query even if they advertise reduced tracking. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

ription: "Multi search engine integration with 16 engines (7 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and WolframAlpha knowledge queries. No API keys required."
---

# Multi Search Engine

Integration of 16 search engines for web crawling without API keys.

## Workflow

1. **Preparation**: AI Agent initializes an empty in-memory cookie store. Cookies are only acquired dynamically during search operations when access is denied

2. **Language Evaluation**: Detect the language attribute of the search query. If the query is in Chinese, use Domestic search engines (Baidu, Bing CN, Bing INT, 360, Sogou, WeChat, Shenma). If the query is non-Chinese, use International search engines (Google, Google HK, DuckDuckGo, Yahoo, Startpage, Brave, Ecosia, Qwant, WolframAlpha). Select engines based on query relevance and availability.

3. **Controlled Search**: Use web_fetch to execute search requests with rate limiting:
   - Add 1-2 second delay be

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file presents the skill's descriptive and instructional content in Chinese, including section headings, feature descriptions, and usage notes. This can violate a language/locale policy when the skill forces a specific language without giving users an explicit choice or documenting that the locale restriction is intentional and justified.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: Automatically routing queries based on detected language to domestic or international engines can silently send user data to jurisdictions or providers the user did not choose. This is especially risky for sensitive searches because the user is not given meaningful control over destination, privacy posture, or legal exposure.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill claims 'All operations run locally, no external data transmission' even though its core function is to send user queries to multiple third-party search engines via web requests. This is a materially misleading privacy statement that can cause users to disclose sensitive queries under false assumptions, increasing privacy and compliance risk.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The configuration hard-codes China-specific search endpoints and locale behavior, including CN-region engines and Bing CN settings, without any visible user choice or opt-in. This can route user queries through region-specific providers and jurisdictions with different censorship, monitoring, and privacy characteristics, creating an avoidable privacy and integrity risk for users who may expect neutral or globally selected search behavior.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file presents its guidance exclusively in Chinese from the title onward, with no indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless clearly justified as region-specific, which is not stated here.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide promotes using cached pages to view deleted content without any caution about privacy, consent, or sensitivity of removed material. This can encourage retrieval of content that was intentionally taken down, potentially exposing personal, confidential, or outdated information users should not casually access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Startpage example explicitly documents `nj=0` to disable family filtering, but provides no warning that this can expose users to adult, explicit, or otherwise unsafe content. In a reusable search skill, users may copy parameters directly, so normalizing unsafe-search bypasses increases the chance of unintended exposure, especially for minors or workplace/school contexts.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The guide defaults to a single language and includes examples centered on Chinese locale settings such as `lr=lang_zh-CN`, `cr=countryCN`, and `kl=cn`, with no opt-in or alternative language guidance. SQP-3 covers natural-language policy issues where a skill effectively forces a specific language or locale without user choice.

Static analysis

No suspicious patterns detected.