Security audit

Multi-Engine Web Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent multi-engine search helper, but it stores cross-session activation preferences and can automatically send future queries to multiple search engines without clear user-facing persistence controls.

Before installing, confirm you are comfortable with search queries being sent to several third-party engines per lookup and with an activation preference being stored for future sessions. Prefer explicit/on-request activation if you handle sensitive topics, and review or remove the saved memory if the skill starts searching more often than intended.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation guidance is broad ('On first use, read setup.md...') and the 'When to Use' section is subjective, which can cause the agent to invoke the skill in situations the user did not explicitly request. In this skill's context, unintended invocation can leak user queries to multiple third-party search engines and amplify data exposure because the rules instruct using at least three engines per request.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The goal says to decide when the skill should activate and which engines should be prioritized, but it does not define clear constraints, exclusions, or disallowed contexts. Missing trigger boundaries make over-invocation more likely and can cause the agent to apply this skill too broadly across unrelated requests.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation modes include 'always when internet lookup is needed' and a mixed mode that auto-triggers for broad categories like news and facts. These conditions are vague and expansive, increasing the chance the skill activates in situations the user did not specifically intend, which can lead to unnecessary external searches and privacy leakage.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs the agent to persist user preferences in both a local memory file and main agent memory without instructing the agent to disclose persistence or obtain explicit consent. Silent persistence creates privacy and transparency risks because users may not realize their behavior preferences are stored across sessions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The setup instructs the agent to store activation preferences in the user's main agent memory, extending persistence beyond this skill's local configuration. This broadens the skill's influence over future behavior and can cause unintended cross-session or cross-context invocation without clear user awareness or scope limitation.

Description-Behavior Mismatch

Low

Confidence: 95% confidence
Finding: The manifest description at L006 says the skill searches Google, Bing, DuckDuckGo, Brave, Startpage, Yahoo, Yandex, Baidu, Sogou, Qwant, Ecosia, Mojeek, and WolframAlpha. The body of the skill documents additional targets beyond that list, including Swisscows, AOL Search, Bing CN/INT, 360 Search, Naver, Seznam, CocCoc, Wikipedia, GitHub Search, Stack Overflow, Semantic Scholar, and PubMed, so the actual documented behavior is broader than the manifest claims.

Static analysis

No suspicious patterns detected.