Security audit

Oxylabs Web Search

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Oxylabs-backed web search and page-reading skill, with normal third-party privacy considerations for searches and URLs.

Install this only if you are comfortable sending search terms, URLs, geo options, and fetched page content to Oxylabs AI Studio under your API key. Avoid secrets, internal-only URLs, personal data, regulated data, or confidential research queries unless that sharing is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation guidance is very broad ('whenever the user wants to search the web, look something up, find current information or news, gather sources and links, or fetch the content of a specific page'), making the skill eligible for many ordinary requests. In an agent setting, overbroad routing increases the chance that user prompts, URLs, or sensitive research tasks are unnecessarily sent to this external service.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explains search and scraping behavior but does not warn that search queries, requested URLs, and potentially retrieved page content are transmitted to Oxylabs, a third-party provider. This omission can mislead users into exposing sensitive prompts, internal URLs, or confidential browsing targets to an external service without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.