Web Search (DDG)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.1

Overview

This is a straightforward web-search skill with disclosed network search and optional file saving, but users should be aware of external queries, local overwrites, and an unpinned dependency.

Install in a virtual environment, consider pinning the DuckDuckGo dependency, avoid searching for secrets or private internal data, and use --output only with deliberate workspace paths because existing files can be overwritten.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-27
Vulnerability Type: Unpinned dependency retrieved from the default Python package index
Risk Level: Medium

Complete Code Snippet:

markdown

Install the required dependency:

```bash
pip install duckduckgo-search

text

Related runtime import in `scripts/search.py:19-24`:

```python
try:
    from ddgs import DDGS
except ImportError as e:
    print(f"Error: Missing required dependency: {e}", file=sys.stderr)
    print("Install with: pip install duckduckgo-search", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The installation instructions retrieve the latest available duckduckgo-search distribution from pip's configured package index without a pinned version or cryptographic hash. Consequently, installations are not reproducible, and the effective dependency code can change after this skill has been reviewed.

The documented distribution name (duckduckgo-search) also differs from the imported module name (ddgs). Although distribution and import names may legitimately differ, the project does not provide a lock file, hash, authoritative source, or verified compatibility version that establishes the intended dependency artifact.

Python packages can execute code during installation and subsequently execute imported module initialization code. If the selected package release or configured index is compromised, attacker-controlled code could therefore run with the privileges of the user installing or invoking the skill.

Attack Path

1. An attacker compromises an applicable package release, package-maintainer account, package-index response, or higher-priority package source configured in the user's pip environment.
2. A user follows the documented pip install duckduckgo-search instruction.
3. Because no version or hash is specified, pip resolves and downloads the attacker-controlled or unexpectedly changed ar ...[truncated 727 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed and compatible version, rather than allowing unconstrained latest-version resolution.
2. Add a requirements or lock file containing cryptographic hashes, and install with hash verification, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Document the authoritative distribution name, version, and upstream source corresponding to the ddgs import.
4. Review the selected release and its transitive dependencies before publishing updated pins.
5. Install dependencies in an isolated virtual environment under a non-privileged account.
6. Use a trusted package index and prevent untrusted additional indexes from taking precedence.
7. Automate dependency vulnerability monitoring while requiring explicit review before updating the lock file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly supports writing search results to arbitrary local files via the documented --output option, but it declares no tool scope or permissions boundary. That mismatch can let an agent invoke file-writing behavior without clear authorization, increasing the risk of unintended overwrites, persistence of untrusted web content, or writing into sensitive workspace locations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level description is so broad that it can match routine browsing, research, fact-checking, and resource-finding requests with little constraint. Over-broad activation criteria can cause unnecessary invocation of a networked skill, sending user queries to an external service and potentially performing file output when a simpler local response would suffice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents live searches against an external service and supports saving returned content to local files, yet it does not warn that user queries leave the environment or that untrusted remote content may be stored locally. This can mislead users and agents into exfiltrating sensitive search terms or persisting attacker-controlled content without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The 'When to Use This Skill' section enumerates many generic cases but provides no guardrails, exclusions, or approval conditions for live web access. In agentic systems, this increases the chance of over-invocation, external data transmission, and use on sensitive prompts that should remain local or require explicit consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

A web search skill needs network access to query DuckDuckGo and formatting logic to present results, but it does not inherently require creating directories and writing arbitrary files. Allowing caller-controlled output paths expands the skill into local file management, which is outside the manifest's stated research/search purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill manifest frames this as a web-search capability that returns results in formatted output, which implies producing search results for the caller. In addition to searching and formatting, the code accepts a user-supplied file path and persists results locally, which is a broader behavior than merely returning formatted search output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.