Security audit

Duckduckgo Search Backup

Security checks for vulnerabilities and agentic risk

Overview

This DuckDuckGo search skill is not malicious, but it needs review because it grants broad Python and package-install authority for a simple search workflow.

Install only if you are comfortable allowing this skill to run Python and package installation commands in your agent environment. Prefer using it in a constrained virtual environment, pinning the duckduckgo-search package version, and reviewing commands before execution.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:24
Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
" ``` 2. Generate and enforce cryptographic hashes through a locked requirements file: ```text duckduckgo-search== \ --hash=sha256: ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Include and pin all transitive dependencies using a reproducible lockfile generated from a trusted environment. 4. Install dependencies in an isolated virtual environment or disposable sandbox with minimal filesystem, credential, and network access. 5. Remove the automatic `pip install --upgrade pip` instruction. Package-manager upgrades should be handled separately through an audited environment-maintenance process. 6. Configure the installer to use a trusted package index and disable unexpected fallback indexes where practical. 7. Periodically review the pinned package version for known vulnerabilities and update the lockfile only after testing and integrity verification. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Granting general Python execution is broader than the documented search functionality and effectively allows arbitrary scripting under the skill. In context, this makes the skill materially more dangerous because a 'search' skill could be repurposed to read/write files, invoke subprocesses, or make unrelated network requests beyond DuckDuckGo queries.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Granting general Python execution is broader than the documented search functionality and effectively allows arbitrary scripting under the skill. In context, this makes the skill materially more dangerous because a 'search' skill could be repurposed to read/write files, invoke subprocesses, or make unrelated network requests beyond DuckDuckGo queries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill body is written in Chinese while the manifest description is in English, and the document does not state that Chinese output is optional or limited to a specific locale. This creates a language/locale policy issue because the skill appears to impose one language without explicit user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest presents the skill as one that retrieves real-time information via DuckDuckGo search, which implies fetching and returning results. The documented example additionally persists results to a local JSON file, introducing local file-write behavior that is not described in the manifest.
Content: No source excerpt is available for this finding.