Security audit

web-search-engine

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a straightforward web search helper that sends search terms to listed search engines and returns results.

Install this only if you are comfortable with your search queries being sent to the selected external search engines. Do not use it for secrets, private customer data, credentials, or highly confidential prompts; results may also be localized toward Chinese-language content.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a Node.js search script that performs external web searches, which implies network-capable behavior, yet the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: an agent or reviewer cannot reliably tell from the manifest that the skill can reach external networks, increasing the risk of unintended data exposure or misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all user-facing instructions in Chinese, which effectively forces a specific language for use of the skill. The policy allows locale constraints only when they are justified or when the user is given a language choice, neither of which is stated here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill sends the user-supplied search keyword directly to third-party search engines (Baidu, 360 Search, Bing, Sogou), which exposes potentially sensitive user queries to external services. In an agent/skill context, users may not realize their prompts or derived search terms are being transmitted off-platform, creating a real privacy and data-handling risk even though this appears to be the intended functionality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code hard-codes an Accept-Language header preferring Chinese locales for outbound requests, which can reveal an assumed regional preference and influence what content is returned without user choice. This is primarily a privacy/transparency issue rather than a direct compromise, but in an agent setting it may cause unexpected localization and data exposure to region-specific services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This request also forces a Chinese-preferred Accept-Language header, overriding user intent and potentially disclosing inferred language or regional preferences to the external search provider. While low severity, it is a genuine privacy and UX issue because the behavior is silent and repeated across providers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The Bing request likewise pins language preferences to Chinese without opt-in, which may lead to region-biased results and unnecessary disclosure of locale assumptions. In a search skill, this is less dangerous than code execution or SSRF, but still a valid privacy/transparency weakness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The Sogou request repeats the same forced Chinese locale behavior, creating consistent silent localization across external requests. This is a low-impact but real issue because it can surprise users and leak preference assumptions to third parties.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.