Back to skill

Security audit

Google-AI Mode 搜索

Security checks across malware telemetry and agentic risk

Overview

This skill provides a paid Google AI search workflow, but it also adds account login, billing, automatic feedback reporting, and persistent local storage that need user review before installation.

Install only if you are comfortable using LinkFox as a paid third-party service, sending queries and account/session metadata to its endpoints, storing full results locally, and using its agent-assisted login and payment flows. Avoid entering sensitive queries or credentials unless you trust the service, and do not use the automatic feedback path without consent from the user whose content may be described.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
94% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation describes capabilities that access environment variables, write files, and make network requests, yet no explicit permissions are declared. This weakens reviewability and consent boundaries because the agent may perform sensitive operations without a clearly constrained permission model, especially when combined with persistent logging and external API calls.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The stated purpose is a Google AI Overview fetcher, but the documented behavior extends into phone-based authentication, account inspection, package selection, order creation, payment QR generation, and payment-status polling. That is a substantial scope expansion into identity, billing, and financial workflows, creating risk of unauthorized charges, credential handling, and privacy exposure well beyond the user's expected search task.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill instructs the agent to automatically report user feedback, dissatisfaction, praise, and even any improvement opportunity to a separate Feedback API without tying that transfer to the user's explicit request. This creates an unnecessary secondary data exfiltration path that may disclose user content, sentiment, or task context to another service.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The document defines a separate feedback-submission API that is unrelated to the core Google AI search function, creating an additional capability channel that could be invoked by an agent without the user explicitly requesting it. Because the feedback payload can include free-form content about what the user said or intended, this expands the skill's behavior beyond search/summarization into outbound data transmission, increasing the risk of unintended data exfiltration or unauthorized secondary actions.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The script persistently stores full API responses, cache entries, session identifiers, and usage metadata on local disk, which is broader than a simple 'return AI overview points' behavior. If responses contain sensitive research inputs, proprietary prompts, personal data, or account-linked results, this creates unnecessary data retention and expands exposure to other local users, backup systems, or later processes.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The documentation promises writes only under the current working directory and explicitly forbids /tmp, but the implementation can silently fall back to ~/linkfox or a temporary directory. That discrepancy is dangerous because users or agents may rely on the documented storage boundary when handling sensitive search content, but data may end up in less-controlled locations with different permissions, retention, or monitoring.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This file implements account onboarding, authentication, API-key retrieval, plan management, and payment-related actions, none of which are necessary for a skill advertised as Google AI Overview search and summarization. That mismatch is dangerous because it creates an unjustified path to collect user phone numbers, SMS codes, and tokens under the cover of an unrelated research capability.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code contains package lookup, order creation, payment QR generation, and order-status polling despite the declared purpose being search/research. In this context, embedding billing flows is highly suspicious because it can induce unauthorized purchases or monetize access through undeclared payment operations.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill sends SMS verification codes and performs login to obtain LinkFox API keys, which is unrelated to a Google-search summarization tool and enables collection of authentication factors and account tokens. In the stated skill context, this substantially increases risk because users would not expect identity verification or token issuance as part of a search feature.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions are broad enough to match many generic research or web-summary requests, increasing the chance the skill is invoked when a narrower or safer tool would be more appropriate. Over-triggering can cause unnecessary external data sharing, unexpected billing, and use of a tool whose side behaviors include logging and feedback reporting.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The feedback endpoint documentation instructs transmission of user-related narrative content in the 'content' field but provides no privacy notice, consent requirement, or data-handling limits. In an agent setting, this can lead to silent disclosure of user prompts, intentions, or outcomes to a third-party endpoint, which is especially risky because the feature is ancillary to the main search function and easy to overlook.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The onboarding flow explicitly asks the user to provide a phone number so a local script can register/login on their behalf, but it gives no privacy notice, consent language, retention limits, or guidance on safe handling of that personal data. In an agent setting, collecting PII without clear data-handling boundaries increases the risk of unnecessary exposure, logging, or misuse of the user's phone number and authentication flow.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The script sends user-supplied search parameters plus environment-derived session metadata to a remote service without any in-band disclosure or consent mechanism. In this skill context, users may assume they are just getting summarized search results, but the code also transmits tracking/context headers that can reveal session linkage or application identity.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
By default, the script writes complete API responses to local files and only prints a summary for large results, which can hide the persistence side effect from users. In a research/search skill, returned content may include sensitive queries, derived summaries, or account-associated metadata, so silent default retention increases confidentiality risk.

Ssd 3

Medium
Confidence
97% confidence
Finding
The skill mandates writing full responses to persistent files in the project workspace, which can retain user queries, derived summaries, citations, account-related error details, and other potentially sensitive content beyond the immediate task. Persistent local storage increases exposure to later unintended access, repository inclusion, or cross-task leakage.

Ssd 3

Medium
Confidence
92% confidence
Finding
The follow-up design tells the agent to summarize prior answers and concatenate that context into new external requests. This can propagate previously collected information, including sensitive or user-specific context, to Google or upstream services even when the follow-up question does not require all prior details.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
84% confidence
Finding
requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.