Security audit

kepler-agent-search

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent web-search skill, but users should understand that searches and page reads go through an external Kepler MCP service.

Install only if you are comfortable routing search queries and selected URLs through Kepler's external MCP service at apisec.cn. Avoid using it for secrets, credentials, private customer data, confidential internal documents, or sensitive personal topics unless you have reviewed and accepted the provider's privacy and security terms.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

Confidence: 96% confidence
Finding: The skill instructs the agent to invoke external web-search tooling whenever network information might be helpful, even if the user did not explicitly request browsing. That broad trigger can cause unnecessary disclosure of user prompts, internal context, or sensitive task details to third-party services, and it increases the chance of prompt-injection exposure from arbitrary web content.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill promotes sending search queries and URLs to external MCP services but does not warn users that their queries, selected URLs, and potentially task-derived context will leave the local environment. This creates a transparency and privacy risk, especially when the agent may automatically search based on implicit need rather than explicit user direction.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The file content is entirely in Chinese and provides no indication that the language should follow the user's preference or system locale. In an agent skill, forcing a single language without opt-in can degrade usability, cause misunderstanding of instructions or outputs, and reduce accessibility for users who expect another language.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The setup guide instructs users to connect their agent to a third-party remote SSE endpoint and to authenticate with an API key, but it does not clearly warn that prompts, searches, extracted content, and potentially sensitive user data will be transmitted to an external service. In an agent context, this omission can lead to unintentional data disclosure because users may enable the MCP server without understanding the privacy and trust implications.

Static analysis

No suspicious patterns detected.