Security audit

Find Agents Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a normal web-search helper with expected network and optional API-key configuration, and no evidence of hidden persistence, destructive behavior, or credential misuse.

Use this only for non-sensitive web research. Avoid entering secrets, private personal information, or confidential business queries, and verify the npm package/repository identity before global installation.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:14