T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
assets/everything/Everything.ini:17- Finding
Bundled Everything Configuration Enables Capabilities Beyond Read-Only Search
- Content
View full analysis
- Remediation
View remediation
Security audit
everything-search
Security checks for vulnerabilities and agentic risk
Overview
This Windows file-search skill is purpose-aligned, but it launches bundled native Everything components and leaves extra file-changing, startup, plugin, and network-capable options enabled.
Review before installing. Use this only if you are comfortable with a bundled Windows Everything engine starting locally and returning local file metadata or content-derived results to the agent. Prefer running as a standard user, avoid broad content searches unless needed, verify the native binaries from a trusted source, and harden the Everything configuration to disable file mutation, plugins, startup/service changes, update checks, and ETP connectivity.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/search.py:57- Finding
Bundled Native Executables Are Loaded and Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/search.py:118- Finding
Unbounded Pagination Arguments Are Passed to Unsigned Native APIs
- Content
View full analysis
- Remediation
View remediation
None: if not 1 <= limit <= MAX_LIMIT: raise ValueError(f"limit must be between 1 and {MAX_LIMIT}") if not 0 <= offset <= MAX_OFFSET: raise ValueError(f"offset must be between 0 and {MAX_OFFSET}") ``` Call this validation before `ensure_server` so malformed requests do not start a native process unnecessarily. Additional controls should include: 1. Use custom `argparse` validators to reject invalid values immediately. 2. Apply the same validation to IPC and CLI execution paths. 3. Add tests for negative values, zero limits, unsigned-boundary values, and very large integers. 4. Maintain a conservative maximum result count suitable for agent output. 5. Return a structured validation error rather than forwarding malformed values to native code. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
text hhh ppp !"#$%&'()))*+,-./0123456789:;<=>?@ABBCDEFGHIGJKLLBMBBNOPQRSTUVWXYZ[\]^G___________________________________________________`___________________________________________________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{__|}~�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
YARA rule 'keylogger_indicators': Keylogger functionality in scripts or source code [malware]
High
- Category
- YARA Match
- Confidence
- 70% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
text r�DefWindowProcW�DestroyWindow�TranslateMessage�WaitMessage�LoadImageWGetDoubleClickTimePeekMessageW_GetSystemMetrics@GetMessageW�WindowFromPoint�IsWindowEnabled�SetWindowsHookExWCallNextHookEx�DispatchMessageWAttachThreadInput�IsDialogMessageWGGetParentBSendMessageTimeoutWGetForegroundWindowGetWindowThreadProcessIdGetFocus�IsWindow�GetAsyncKeyState"GetKeyNameTextW�MapVirtualKeyExW$GetKeyboardLayout�UpdateWindowTCreateDialogIndirectParamW^CreatePopupMenu�TrackPopupMenu�MapWindowPoints�SetWindowLongWBCloseClipboard�IsZoomedCallWindowProcW�MsgWaitForMultipleObjectsBGetMonitorInfoW�InsertMenuWGetDlgItemYSetDlgItemTextW�DrawTextW%GetKeyboardLayoutListwGetWindowPlacement�LoadIconW�IsClipboardFormatAvailable9GetMenuState�GetClassInfoExW AppendMenuWGSetCapturePtInRect�EnumChildWindowssGetWindowLongWRegisterClipboardFormatWaCreateWindowExWRegist
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and operationalizes shell execution and implicit process startup, but it does not declare any explicit tool scope or permissions boundary. This is dangerous because a host agent may invoke shell/network-capable behavior without clear user-facing authorization constraints, increasing the chance of unintended execution or abuse through crafted user queries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description omits a clear warning that searching local files can expose sensitive filenames, directory structures, and, when content indexing is enabled, file contents. In a file-search skill, this materially affects privacy expectations because users may invoke broad searches without realizing the results can reveal secrets, personal data, or system-sensitive paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill states that it may automatically start an embedded Everything executable, but this behavior is not clearly surfaced as a user warning or consent requirement. Automatically launching bundled executables on the user's machine increases execution risk and surprises the user with local code/process execution beyond passive search semantics.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The bundled configuration explicitly enables destructive file operations such as delete, rename, cut/paste, and drag-drop even though the skill is described as a local file search tool. In an agent context, exposing mutation-capable actions beyond the stated read-oriented purpose increases the risk of unintended or unauthorized file tampering if the embedded Everything UI/API is reachable through the skill workflow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The setting allow_set_file_time=1 permits modification of file timestamps, which is a write operation inconsistent with a search-only skill. Timestamp changes can undermine auditability, interfere with user workflows, or be abused to conceal activity by altering forensic metadata on local files.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The top-level documentation claims the script only calls the Everything engine, but the actual implementation can launch Everything.exe. Deceptive or incomplete capability disclosure undermines informed consent and increases risk when code is run by an automation agent on a user's machine.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python file contains natural-language descriptions entirely in Chinese, including the module docstring and CLI help text, which indicates the skill is designed around a fixed language/locale. The policy requires flagging language or locale constraints when the skill does not offer user opt-in or clearly justify that the tool is region-specific.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if not _ES_EXE.exists(): return False try: r = subprocess.run( [str(_ES_EXE), "", "-n", "1"], capture_output=True, encoding="gbk",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd += ["-offset", str(offset)] try: proc = subprocess.run( cmd, capture_output=True, encoding="gbk",
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill behavior exceeds its stated scope by not only querying Everything but also starting a bundled server executable when unavailable. This mismatch is dangerous in an agent setting because users may approve a 'search' capability without realizing it can execute software on the host.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 90% confidence
- Finding
The script silently launches a bundled Everything.exe when the engine is unavailable, causing execution of a local executable as a side effect of a search request. In an agent-skill context, auto-starting software expands trust to a bundled binary and can surprise users or violate least-privilege expectations if that binary is modified, malicious, or outdated.
- Content
python return True if _BUNDLED_EXE.exists(): try: subprocess.Popen( [str(_BUNDLED_EXE)], creationflags=0x00000008, # DETACHED_PROCESS )
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Natural-language instructions, examples, and operational guidance are presented entirely in Chinese, which effectively forces a specific language for users reading the skill documentation. The file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific use case.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The configuration allows features unrelated to core local search, including update checks and connection to an ETP server. While these settings are commonly benign in a desktop app, bundling them into an agent skill expands the attack surface and may permit unexpected outbound connectivity or remote interaction that users would not expect from a local-only file search capability.
- Content
Static analysis
No suspicious patterns detected.