Security audit

Web Claude

Security checks for vulnerabilities and agentic risk

Overview

This search skill is mostly coherent, but it automatically saves all queries and results to agent memory and can use a logged-in Claude browser session without clear opt-out or retention controls.

Install only if you are comfortable with search terms and results being saved under memory/research/. Avoid using it for secrets, personal data, confidential business research, or regulated information unless you first add a no-cache mode, deletion/retention controls, and confirmation before using the logged-in claude.ai browser fallback.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:95
Finding: Automatic Persistence of Untrusted Search Content in Agent Memory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states that all search results are automatically saved to disk, including the original query, retrieved links, summaries, and extracted insights, but does not warn that queries may contain sensitive user data. This creates a clear privacy risk because personal, proprietary, or regulated information could be written to persistent storage without user awareness or minimization.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Persisting every search query and extracted result to memory/research/ can retain sensitive prompts, confidential research topics, and copied third-party content in plain language. Because this is framed as automatic behavior rather than an explicit user choice, it materially increases the risk of inadvertent data retention, later exposure, or reuse by other tools or users with filesystem access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger examples are broad enough that an agent could invoke this skill for generic requests like 'search' or 'find' without strong scoping or consent boundaries. In a skill that can perform web access, browser automation, and persistent caching, ambiguous activation increases the chance of unintended external requests and data persistence from ordinary user prompts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.