本地搜索服务一键搭建

• Outcome: Review
• Latest audit: Nov 6, 2026 · 2:48 AM UTC
• Version: 0.3.8

Overview

The skill’s privacy promise conflicts with its use of external search engines, and missing deployment files prevent checking important security settings.

Treat searches as leaving your network and avoid confidential queries. Obtain and review the missing deployment files before installation, especially container permissions and network exposure. Verify and pin the payment helper, personally confirm the actual bill, and inspect the delivered package before running its contents. All eight bundled files were inspected, including the scanner’s partial scripts; external dependencies and the paid package remain unreviewed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (19)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A payment flow is a material capability not disclosed by the description of one-click local search setup. Although purchasing a package could support a broader installation process, this chunk specifically delegates payment processing to an external CLI rather than performing setup. The code does not itself demonstrate automatic payment confirmation, access to payment keys, or execution of an installer.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied script performs no local search-service installation or configuration. Instead, it requests a payment-required response, extracts and stores billing data, and directs the user to a separate payment script. A paid-package acquisition workflow is a material, undeclared aspect of the claimed one-click setup purpose. This chunk does not itself execute a payment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Downloading and extracting a search-service package could support the declared setup purpose. However, this chunk primarily implements a payment-gated fulfillment workflow, a material commercial and credential-handling capability absent from the description. It defaults to contacting https://linkkhub.top/api/pack/full and saves payment proof locally. The supplied chunk does not itself initiate payment or install, configure, or start the search service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Checking for software updates can support local service setup, but this script specifically implements a paid-package update workflow that the description does not disclose. It requests a manifest from https://linkkhub.top by default, reads local version and payment-state files, and invokes sxp-complete.sh with the stored proof when payment records exist. Otherwise, it instructs the user to complete a payment process. The supplied chunk does not itself charge the user or demonstrate transmission of the payment proof; those behaviors cannot be established without inspecting the invoked script.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

2. `bash scripts/sxp-pay.sh` → 账单交给支付宝官方买家 CLI alipay-bot 收银，**用户本人扫码/确认付款；未获明确同意不得代付**

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

bash scripts/selftest.sh # Windows PowerShell 用: powershell -File scripts/selftest.ps1

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

- `scripts/selftest.ps1` —— Windows 原生 PowerShell 自检（与 bash 版等价）

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/sxp-check-update.sh (reported line 10)May include surrounding context.

sh

STATE="${SXP_STATE_DIR:-$HERE}/.sxp-state"
PACK_DIR="${SXP_PACK_DIR:-$HERE/searxng-full-pack}"

REMOTE=$(curl -s -m 15 "$BASE/api/pack/manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("version",""))' 2>/dev/null || true)
[[ -n "$REMOTE" ]] || { echo "拿不到服务端版本（服务不可达？稍后再试）"; exit 1; }
LOCAL=$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1])).get("version",""))' "$PACK_DIR/version.json" 2>/dev/null || echo "")

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The deployment instructions omit disclosure that search queries are sent to external search providers and instead claim queries stay within the home.

Medium

• Category: Output Handling
• Confidence: 99% confidence

Finding

The claim that queries stay within the home conflicts with the documented use of external search providers such as Bing and Baidu. Users or agents relying on that assurance could submit confidential queries that the local metasearch service subsequently forwards outside their network.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @alipay/agent-payment'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation instruction uses npx with an automatically accepted, mutable @latest package, allowing newly published package code to execute without a reviewed version boundary. This is a supply-chain risk in a payment-related workflow, although the source does not establish that this package is an MCP server or is currently malicious.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/deploy.sh (reported line 19)May include surrounding context.

sh

;;
esac
command -v docker >/dev/null 2>&1 || { echo "!! 未找到 docker："; case "$OS" in Darwin) echo "   macOS 请先装 OrbStack（brew install orbstack）或 colima（brew install colima docker docker-compose && colima start --memory 2）";; MINGW*|MSYS*|CYGWIN*) echo "   Windows 请装 Docker Desktop 并启用 WSL2 后端（见 docs/INSTALL-WINDOWS.md），推荐直接走 PowerShell 原生路径";; *) echo "   Linux/NAS 安装 Docker：curl -fsSL https://get.docker.com | sh；群晖/飞牛用套件中心";; esac; exit 1; }
docker compose version >/dev/null 2>&1 || { echo "!! 未找到 docker compose 插件（老版可试 docker-compose，本包需 compose v2）。安装: sudo apt install docker-compose-plugin 或 NAS 商店更新 Docker 套件"; exit 1; }

echo "[2/4] 准备数据目录与配置"
mkdir -p "$DATA/searxng"

The local-search setup skill implements an undisclosed payment-gated package fulfillment workflow.

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The manifest describes one-click setup of a local search service, but L27–L35 invoke alipay-bot to query a payment order and request a commercial package. L38–L47 also support submitting a payment proof to a remote fulfillment endpoint and retaining that proof locally. Downloading setup resources is expected, but payment-order handling and persistent purchase credentials materially extend the advertised scope; this file does not itself demonstrate initiating a charge.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/sxp-complete.sh (reported line 39)May include surrounding context.

sh

fi

SEED=$(cat "$STATE/seed" 2>/dev/null || echo manual)
STATUS=$(curl -s -X POST "$BASE/api/pack/full" -H "Payment-Proof: $PROOF" \
  -H 'Content-Type: application/json' -d "{\"client_seed\":\"$SEED\"}" \
  -o "$STATE/result.json" -w '%{http_code}')

MCP server referenced without pinned version: 'npx -y @alipay/agent-payment'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The missing-CLI message recommends an unpinned npx @latest invocation, which executes whatever package release is current when followed. Although this script only prints the instruction and the MCP classification is unsupported, the recommendation introduces a supply-chain execution risk on a host used for payments.

Content

No source excerpt is available for this finding.

The local-search setup skill initiates an undeclared paid-package checkout through Alipay.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The manifest describes one-click setup of a local search service, but this script invokes alipay-bot's 402-buyer-pay command with a saved bill and an external package endpoint, identifying the purchase as a 0.99-yuan SearXNG package. Initiating a commercial checkout is a material capability beyond the stated setup purpose, even though payment confirmation is left to the user.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/sxp-probe.sh (reported line 14)May include surrounding context.

sh

if [[ ! -f "$STATE/seed" ]]; then head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n' > "$STATE/seed"; chmod 600 "$STATE/seed"; fi
SEED=$(cat "$STATE/seed")

STATUS=$(curl -s -D "$STATE/headers" -o "$STATE/body" -w '%{http_code}' \
  -X POST "$BASE/api/pack/full" -H 'Content-Type: application/json' \
  -d "{\"client_seed\":\"$SEED\"}")

The script implements a remote paid-package billing workflow rather than the advertised one-click local search deployment.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The manifest describes one-click setup of a local search service, but L14–L16 POST a persistent client identifier to a remote paid-package endpoint. L22–L36 then save a payment request and order number and direct the user to a payment script; this purchase workflow is not disclosed by the manifest, and this file does not itself charge the user.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The script prints, rather than executes, a recommendation to pipe a mutable remote installer directly into sh. If a user or deployment agent follows that advice, compromised installer delivery can execute arbitrary code with the caller's privileges; HTTPS does not provide a reviewed version or independent integrity check.

Content

Scanner excerpt · scripts/deploy.sh (reported line 18)May include surrounding context.

sh

echo "检测到 Windows shell 环境。建议改用原生路径：docs/INSTALL-WINDOWS.md（方式 A），或在 WSL 终端里重新运行本脚本。继续尝试……"
    ;;
esac
command -v docker >/dev/null 2>&1 || { echo "!! 未找到 docker："; case "$OS" in Darwin) echo "   macOS 请先装 OrbStack（brew install orbstack）或 colima（brew install colima docker docker-compose && colima start --memory 2）";; MINGW*|MSYS*|CYGWIN*) echo "   Windows 请装 Docker Desktop 并启用 WSL2 后端（见 docs/INSTALL-WINDOWS.md），推荐直接走 PowerShell 原生路径";; *) echo "   Linux/NAS 安装 Docker：curl -fsSL https://get.docker.com | sh；群晖/飞牛用套件中心";; esac; exit 1; }
docker compose version >/dev/null 2>&1 || { echo "!! 未找到 docker compose 插件（老版可试 docker-compose，本包需 compose v2）。安装: sudo apt install docker-compose-plugin 或 NAS 商店更新 Docker 套件"; exit 1; }

echo "[2/4] 准备数据目录与配置"