Uws Publish

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 2.2.1

Overview

This skill is a coherent web-search integration that sends searches to configured third-party providers, with some documentation and dependency hygiene gaps users should understand.

Install this only if you are comfortable sending search terms, filters, and related metadata to the configured external search providers. Avoid searching for secrets or regulated data, configure only providers you approve, and consider skipping the unused unpinned requests install instruction unless the publisher updates the dependency guidance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: README.md:17
• Finding: Unnecessary and Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `README.md:17-22` and duplicate installation guidance at `README.md:172-178` **Vulnerability Type**: Unnecessary unpinned dependency and avoidable supply-chain exposure **Risk Level**: Low ### Vulnerable Code Snippet ```markdown ### Python Dependencies ```bash pip install requests ``` > `requests` is the only hard dependency. The script does not use additional packages such as `httpx`, `openai`, or `tenacity`. ``` The installation instruction is repeated in the development section: ```markdown ## Development ```bash # Clone the repository git clone https://github.com/naive-white-expert/unified-web-search.git cd unified-web-search # Install dependencies (requests only) pip install requests ``` ``` ### Technical Analysis The project instructs users to install the latest available version of `requests` without a version constraint, lock file, or package hash. However, the audited implementation uses Python's standard-library `urllib.request` for all outbound HTTP operations and does not import `requests`. The dependency therefore provides no functionality required by the current code while unnecessarily expanding the installation-time supply-chain attack surface. Package resolution can be influenced by the configured Python package index, mirrors, proxy settings, or a future compromise of a package release or transitive dependency. An unpinned installation also prevents reproducible dependency resolution. If a source distribution or maliciously modified package is selected, installation-time build hooks could execute with the privileges of the user running `pip`. ### Attack Path 1. A user follows the documented installation instructions. 2. The user runs `pip install requests` without a version constraint or verified hash. 3. `pip` resolves the package and its dependencies from the user's configured package index or mirror. 4. An attacker who has ...[truncated 1061 chars]
• Remediation: ## Remediation Suggestions 1. Remove both `pip install requests` instructions because the current implementation uses only the Python standard library. 2. Remove the statement that `requests` is a hard dependency. 3. Explicitly document that the Skill has no third-party runtime dependencies. 4. If `requests` is introduced in the future, declare it in a reviewed dependency manifest rather than an ad hoc installation command. 5. Pin audited versions and generate a lock file with cryptographic hashes, such as a hash-locked requirements file. 6. Install packages from a trusted, explicitly configured index and require hashes during automated deployment. 7. Add CI checks that compare imported third-party modules with declared dependencies to prevent unnecessary packages from being added.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly promotes sending user search queries to multiple third-party providers but does not warn that prompts, keywords, site filters, and related metadata may be transmitted off-platform. In a skill context, users may assume searches are local or mediated only by the host runtime; lack of disclosure creates a privacy and data-handling risk, especially if users submit sensitive or regulated information.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises network use and multiple API keys, but it does not declare an explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and makes it harder for a host agent or reviewer to understand that the skill may access environment variables, files, and the network, increasing the risk of unintended capability use.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes a unified web search interface but does not clearly warn users that their queries may be transmitted to one or more third-party providers. Search queries often contain sensitive business, personal, or investigatory context, so undisclosed forwarding can create a privacy and compliance exposure even when the feature works as intended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation says the skill may automatically switch backup keys, routes, and fallback providers, but it does not warn that these mechanisms can expand the set of third parties receiving the user's query. This increases data-sharing unpredictability and can violate user expectations, internal policy, or data residency requirements, especially when region-based routing changes providers.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: Natural-language content in the module docstring and function documentation is exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a language/locale policy concern unless the constraint is explicitly documented and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sends user queries to multiple third-party search providers and may automatically fail over between them, but the code does not provide any built-in disclosure, consent, or data-minimization control before transmission. In an agent setting, users may assume a local tool while sensitive prompts, names, or proprietary data are actually exported to external services, increasing privacy and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

end_date: Optional[date] = None,
    topic: str = "general",
) -> dict:
    endpoint = "https://api.tavily.com/search"
    payload = {
        "api_key": api_key,
        "query": query,

• Confidence: 94% confidence
• Finding: This code transmits the raw search query and an API key to Tavily over the network. Although HTTPS is used, the security issue is the undisclosed external transfer of potentially sensitive user input to a third party, compounded by automatic provider selection and fallback behavior that can broaden data sharing beyond user expectations.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _tencent_wsa_search_with_key(api_key: str, query: str) -> dict:
    endpoint = "https://api.wsa.cloud.tencent.com/SearchPro"
    payload = {"Query": query}
    try:
        data = json.dumps(payload, ensure_ascii=False).encode("utf-8")

• Confidence: 92% confidence
• Finding: This function sends the user's query to Tencent Cloud WSA, creating the same third-party data exposure risk as the other providers. In this skill, automatic routing and fallback increase the likelihood that a user's data is shared externally without clear awareness or provider-specific approval.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This markdown file contains user-facing natural-language guidance only in Chinese, and there is no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown file contains user-facing instructional content only in Chinese, which can amount to a language policy issue when no user opt-in or alternative language option is provided. There is also no indication that the skill is intentionally limited to a Chinese-speaking or China-specific audience for compliance or regional reasons.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language docstring is written only in Chinese, which can indicate a language-specific constraint without any visible opt-in, alternative locale support, or justification. The policy specifically calls for flagging language or locale constraints when they are imposed without user choice.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The module accesses sensitive credentials from environment variables such as BAILIAN_API_KEY, DASHSCOPE_API_KEY, TAVILY_API_KEY, ZHIPU_API_KEY, TENCENT_WSA_APIKEY, and WEB_SEARCH_API_KEY, and also reads them from a local config file. There are internal comments for developers, but no user-facing notice in the public interface that the skill reads credentials from the host environment.

Static analysis

No suspicious patterns detected.