Verified Search Pro

• Outcome: Review
• Latest audit: Jul 22, 2026 · 1:43 AM UTC
• Version: 0.1.0

Overview

The skill is a transparent web research tool, but its evidence labels can conflict in ways that may make weak background sources look like trusted conclusions.

Install only if you are comfortable with user queries being sent to selected search providers and with short-lived local caching of fetched pages. Treat claims-json trusted conclusions as candidates, and manually review evidence items that also appear in perspective_map or are marked must_not_be_used_as_fact. Prefer explicit invocation for sensitive searches rather than broad auto-loading.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The package creates a contradiction in its trust model: evidence explicitly labeled in perspective_map as 'must_not_be_used_as_fact' is also used to support a trusted candidate conclusion. This can cause downstream agents to treat low-trust or context-only material as verified fact, undermining provenance and enabling silent misinformation propagation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Representative evidence ev-2 is marked as not usable as fact in the perspective layer but is simultaneously used to support the trusted candidate conclusion. Because ev-2 is also undated context, this inconsistency increases the chance that agents will promote ambiguous material into asserted factual output.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Evidence ev-3 is simultaneously designated as perspective-only and used as support for the package conclusion, which violates the file's own safety semantics. Even though it is relatively fresh, the contradictory labels make automated trust decisions unreliable and can mislead consumers into overestimating confidence.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Evidence ev-4 is declared unusable as fact but still appears as support for a trusted candidate conclusion, defeating the purpose of the perspective safeguard. Since this source is also undated in the package, the contradiction can magnify uncertainty while presenting the result as more trustworthy than warranted.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Evidence ev-5 is marked 'must_not_be_used_as_fact' yet is reused as support for the package conclusion, creating a self-contradictory evidence policy. In an agentic setting, such contradictions are dangerous because automated consumers may ignore the restrictive label and propagate unsupported claims as trusted outputs.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The auto-load trigger phrases are very broad and overlap with common, benign user requests such as general research, verification, comparison, and background lookup. In an agent environment, this can cause the skill to activate outside its intended scope, unexpectedly steering workflows, consuming networked search capabilities, and injecting its own procedural instructions into unrelated tasks.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger table uses very broad phrases such as 'research,' 'market analysis,' 'verify this,' and 'search more sources,' which can cause the skill to activate for many ordinary user requests outside a clearly bounded scope. In an agent environment, ambiguous activation can lead to unnecessary external searching, over-collection of data, or the skill overriding more appropriate tools and workflows.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger keywords include very broad terms like '搜索', '搜一下', and '查一下', which overlap with ordinary user requests and can cause the skill to activate outside its intended high-assurance fact-checking context. Over-broad activation increases the chance the agent unnecessarily escalates to external search and tool use, expanding data exposure and behavior surface for routine prompts.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation scenarios are described in broad natural-language categories without strict boundaries for when the skill should or should not run. In an agent environment with tool access, this ambiguity can cause over-activation on loosely related prompts, leading to unnecessary network access, data handling, and potentially surprising behavior for users.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: When run directly, the script loads configuration from VSP_* environment variables and then prints the fully merged configuration to stdout. If secrets such as API keys or tokens are supplied through environment variables, they can be exposed in terminal logs, shell history captures, CI logs, or other output collectors. The skill context increases risk because this file is a configuration loader and direct execution is explicitly supported via the __main__ block.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

"evidence_id": "ev-5",
      "url": "https://mchd.in-en.com/html/chd-2459542.shtml",
      "title": "比亚迪、吉利、上汽、东风、特斯拉位居前五！2026年1-4月新能源汽车重点企业销量TOP15公布",
      "snippet": "4月，新能源汽车国内销量比例为56.3%;新能源乘用车国内销量占乘用车国内销量比例为61.4%;新能源商用车国内销量占商用车国内销量比例为32.8%。\n\n1-4月，新能源汽车国内销量比例为45.3%;新能源乘用车国内销量占乘用车国内销量比例为49.4%;新能源商用车国内销量占商用车国内销量比例为25.4%。\n\n新能源汽车重点企业销售情况：\n\n原文如下：\n\n图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片\n\n来源：中国汽车工业协会\n\n关键词： 新能源汽车\n  电动汽车\n  比亚迪\n\n### 特别声明\n\n国际充换电网声明：本文仅代表作者本人观点，与国际充换电网无关，文章内容仅供参考。凡注明“来源：国际充换电网”的所有作品，版权均属于国际充换电网，转载时请署名来源。\n\n本网转载自合作媒体或其它网站的信息，登载此文出于传递更多信息之目的，并不意味着赞同其观点或证实其描述。如因作品内容、版权和其它问题请及时与本网联系。\n\n微信\n朋友圈\n\n点赞\n\n### 相关推荐\n\n#...",
      "snippet_source": "content",
      "source_engines": [
        "tavily"

• Confidence: 86% confidence
• Finding: 图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片图片

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/10-api-setup.md:90