谷歌搜索专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:01 AM UTC
• Version: 1.0.1

Overview

The published Google search skill bundles sensitive account, billing, public upload, and separate text-generation capabilities that are not clearly scoped in the top-level purpose.

Install only after reviewing whether you want the broader LinkFox package, not just Google AI search. Avoid sensitive queries or files unless you accept transmission to LinkFox services, do not upload private files because the upload skill returns public URLs, and verify environment variables such as LINKFOX_TOOL_GATEWAY and API keys before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The code builds outbound request URLs from environment-controlled base URLs and then sends authentication material, SMS-login data, tokens, and account metadata to those destinations via requests.post. In a skill/runtime environment where env vars can be influenced by a host, wrapper, or attacker, this enables SSRF-style redirection and credential exfiltration to attacker infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 97% confidence
• Finding: The gateway URL is similarly derived from environment input and used in urllib.request.urlopen with the Authorization header populated from the API key. If an attacker can alter LINKFOX_AGENT_API_URL or related fallback variables, they can redirect authenticated traffic and harvest API keys or trigger requests to internal network targets.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST destination is derived from environment-controlled base URLs via helper functions, so a caller can redirect login and token-bearing requests to an attacker-controlled endpoint. Because these requests may include phone numbers, SMS codes, access tokens, refresh tokens, API keys, and UID headers, SSRF-style redirection here can lead to credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request URL is also built from environment-controlled configuration and then passed to urlopen with the Authorization header populated from the API key. If an attacker can influence environment variables, they can cause authenticated requests to be sent to an arbitrary server and capture the API key or induce unintended outbound requests.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises use of capabilities such as environment access, file read/write, and network operations without any declared permissions boundary. This creates a trust and review gap: downstream systems or users cannot accurately assess what the skill may access, and undeclared file/network behavior can enable unintended data exposure or persistence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is search research, but the static finding indicates hidden behavior for SMS verification, account login, API key retrieval, package purchase, order creation, QR-code payment generation, and payment-status polling. That is a severe description-behavior mismatch and could be used to phish credentials, trigger unauthorized purchases, or exfiltrate billing/account secrets under the guise of a harmless research tool.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation promises that responses are always written under the current workspace and explicitly forbids writing to /tmp, but the actual implementation can fall back to ~/linkfox or the system temp directory. This discrepancy can cause sensitive search results to be stored in less controlled locations than operators expect, increasing accidental disclosure risk on shared systems or ephemeral environments.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file's behavior is materially inconsistent with the declared skill purpose: instead of Google search research, it performs account onboarding, SMS authentication, API-key retrieval, plan listing, ordering, and payment handling. This scope mismatch is dangerous because users and hosts may grant the skill trust and permissions appropriate for research, while it actually performs account and commerce operations involving credentials and billing.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This code can create paid orders and generate payment QR codes, enabling direct billing actions from within a skill that is supposed to do search research. In context, that is especially risky because it expands from information gathering into financial transaction initiation, increasing the chance of unauthorized charges or deceptive user flows.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill performs SMS-based login and can retrieve or generate API tokens, which exceeds the expected scope of a research assistant and introduces sensitive credential-handling behavior. In this context, such functionality increases risk because a user may not expect the skill to authenticate accounts or mint reusable API credentials.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file content documents a different skill (`linkfox-aigc-textgen`) than the declared skill (`linkfox-expert-google-search-researcher`), creating a clear skill identity mismatch. This can cause an agent or operator to invoke unintended capabilities, route user data to the wrong backend, or rely on incorrect trust assumptions about what the skill actually does.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document explicitly states it is for `linkfox-aigc-textgen`, directly contradicting the analyzed skill identity. This strengthens the evidence of packaging confusion or cross-skill content inclusion, which can mislead downstream systems and reviewers about the skill's real behavior and data flows.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file clearly implements asynchronous AI text generation against /aigc/textGenAsync and /aigc/textTaskQuery, while the skill metadata describes a Google search research tool. This capability mismatch is dangerous because callers may grant the skill broader trust, permissions, or workflow placement based on its declared purpose, enabling unintended data handling and weakening security review assumptions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements SMS login, API key issuance, account/team discovery, subscription management, and payment ordering, which is materially unrelated to the declared Google search research skill. This mismatch indicates hidden capability expansion that collects credentials and enables billing actions, increasing the chance of deceptive or unauthorized account operations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Embedding order creation, plan purchasing, and QR-code payment rendering inside a search-research skill introduces unjustified financial functionality. In this context, the danger is elevated because users invoking a research skill would not reasonably expect billing operations, making social engineering or accidental charges more plausible.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The documented capability is a generic file-upload mechanism using remote STS credentials and public URL registration, which is materially unrelated to the declared purpose of Google AI Mode search research. This mismatch is dangerous because it can hide unexpected data exfiltration or unauthorized content staging behind a benign-looking research skill, expanding the skill’s effective privileges beyond user expectations.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Remote file upload plus session deliverable registration gives the skill the ability to transfer local files to an external storage service and surface public URLs, a powerful side effect not justified by the stated research-only purpose. In this context, the mismatch makes the feature especially risky because it could be used to exfiltrate sensitive local artifacts or stage arbitrary content under the cover of a search workflow.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements local-file upload to a public OSS endpoint, but the declared skill metadata describes a Google search research capability. This mismatch is dangerous because it hides networked exfiltration functionality behind an unrelated skill identity, reducing user and reviewer awareness and increasing the chance that sensitive local files are uploaded without informed consent.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The script uploads one or more local files to Alibaba Cloud OSS and returns publicly accessible HTTPS URLs. For a Google search research skill, this capability is unjustified and materially increases the risk of sensitive data exposure or exfiltration, especially because the output explicitly surfaces the public URL and local absolute path.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger definition is intentionally expansive: it says the skill should activate not only for explicit mentions of Google AI/AI Overview, but also whenever a user's need can be interpreted as 'use Google search + AI summary of web points.' That broad semantic matching can cause unintended invocation, leading the agent to route general research or web-search tasks into a paid, single-round tool that may not match user intent. The risk is amplified because the skill has billing implications and live external querying, so misrouting can waste credits, expose user queries to third-party services, and degrade reliability.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The boundary guidance treats very common phrases such as 'AI 帮我汇总网上的说法' or '用谷歌搜一下' as sufficient to trigger this specialized skill. Because these are ordinary expressions for generic web research, the skill may over-capture a wide range of unrelated requests and bypass more appropriate tools or workflows. In context, this is dangerous because the tool is billed, performs live external requests, and is unsuitable for multi-turn or structured-data tasks, so accidental activation can create unnecessary spend and poor task handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Feedback API sends free-form `content` and related metadata to an external service, but the documentation does not warn against including personal data, sensitive user prompts, or confidential business information. In an agent skill context, this omission can lead developers or downstream agents to forward raw user messages to a third party without informed consent, creating privacy, compliance, and data-handling risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to collect a user's phone number and use it to drive registration and login flows, but provides no privacy notice, consent language, retention limits, or handling safeguards for this personal data. In an agent setting, this creates a real risk of unnecessary collection or unsafe disclosure of sensitive user information, especially when passed to scripts or surfaced in logs.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The skill sends user-supplied search content to a remote service and persistently stores full responses on disk by default, yet the code provides no consent prompt, minimization, or redaction controls. In this skill context, queries and AI-generated research results may contain sensitive business research, customer data, or proprietary prompts, so silent transmission and retention materially increase privacy and data-handling risk.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list includes very broad phrases such as '帮我写一段', 'text generation', and 'generate text', which are common in ordinary conversation and can cause this skill to activate unintentionally. In an agent environment, over-broad activation can route unrelated user requests into this skill, leading to incorrect tool use, unintended data handling, and chaining into downstream AIGC skills described in the document.

Static analysis

No suspicious patterns detected.