Spotlight Search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 0.1.2

Overview

This macOS Spotlight search skill is mostly purpose-aligned, but it has a real directory-scoping bug and includes a privileged system-wide reindex command that users should review carefully.

Install only if you are comfortable with an agent searching local Spotlight-indexed content. Prefer explicit -onlyin directory scoping, avoid relying on the bundled script for home-directory-limited searches until fixed, and do not approve sudo mdutil -E / unless you intentionally want a system-wide Spotlight reindex.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/spotlight_search.sh:173

Finding

Home Directory Scope Bypass Causes Global Spotlight Search

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code substantially matches the core idea of searching files and apps on macOS with Spotlight and a fallback mechanism. However, the declared description explicitly includes searching metadata and references Spotlight CLI tools mdfind, mdls, and mdutil. In the supplied code, only mdfind is used from Spotlight tools, and the fallback is a plain find-based filename/extension search. There is no use of mdls for metadata retrieval or mdutil for index status/management, so prompts like 'check file metadata' are not actually supported by this code chunk. Because metadata handling is a material declared capability, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description lists triggers such as "search my computer" and "find PDFs," which are common natural-language requests and not tightly scoped to this specific skill. The file does not provide negative examples or explicit boundaries for when the skill should not activate, increasing the chance of over-broad matching.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill includes a privileged command, sudo mdutil -E /, which performs a system-wide Spotlight reindex. Even though the text says to do this only with explicit user approval, surfacing a root-level command in a reusable skill creates a risk that an agent or user may execute a disruptive privileged operation too readily, affecting system performance and potentially exposing broader command-execution pathways.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

1. Check indexing status: `mdutil -s /`
2. Ensure the directory is indexed (Spotlight excludes some system and Library folders)
3. Re-index only with explicit user approval because it is a privileged, system-wide action: `sudo mdutil -E /`

**Query syntax errors?**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/mdfind-queries.md (reported line 182)May include surrounding context.

md

- Spotlight indexing may exclude certain directories (e.g., `~/Library`, system folders). Use `mdutil -s /` to check indexing status.
- Newly created files may not appear until the index updates (usually within minutes).
- To rebuild the index for a volume: `sudo mdutil -E /`.
- `mdfind` only searches indexed volumes. Use `-a` to search all volumes (including non‑indexed) but performance will be slower.

## Further Reading

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents mdfind as searching file contents and metadata across indexed volumes, which can expose sensitive filenames, document contents, email addresses, phone numbers, and application inventory. Under the markdown-specific warning criterion, the document should disclose privacy implications before presenting broad search examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The listed attributes and examples show how to search for personal contact data and recent file activity, which can affect user privacy if used indiscriminately. The markdown guidance does not include any caution that these queries may reveal personal information or usage history.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.