Ae1
High
- Category
- analysis-evasion
- Content
- `references/international-search.md` - International search guide
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
Multi Search Engine Local
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a search-integration guide, but it includes examples for finding login/admin pages and exposed password text, which should be reviewed before installation.
Install only if you are comfortable with a search guide that sends queries to external providers. Avoid putting secrets, internal URLs, personal data, or confidential investigation terms into searches, and treat the password/admin-page examples as unsafe patterns that should be removed or ignored.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)
Natural-Language Policy Violations
Medium
- Confidence
- 83% confidence
- Finding
- SQP-3 applies to all file types and covers language or locale policy violations. The natural-language content and headings are exclusively in Chinese, and the file does not indicate that the skill is China-specific or provide an opt-in or alternative language.
Missing User Warnings
Medium
- Confidence
- 95% confidence
- Finding
- The skill repeatedly demonstrates `web_fetch` calls to third-party search engines but does not warn users that their queries, operators, and possibly sensitive research terms will be transmitted to external services. In a search-integration skill, this omission materially increases privacy and data-handling risk because users may treat the examples as local or neutral lookups rather than outbound requests to multiple providers with different logging and tracking practices.
Natural-Language Policy Violations
Medium
- Confidence
- 83% confidence
- Finding
- This manifest-like config includes multiple CN-specific engines and region values, such as Baidu and Bing CN, but provides no natural-language indication that users can choose a locale or opt into China-specific routing. Under the policy, forcing a specific language/locale context without user choice can be a natural-language policy concern even in config values.
Ssd 2
Medium
- Confidence
- 92% confidence
- Finding
- The example `inurl:login admin` explicitly teaches discovery of login or admin pages, which can facilitate reconnaissance for unauthorized-access attempts. While not an exploit by itself, it meaningfully assists targeting and should be treated as risky in an agent skill that operationalizes search queries.
Ssd 2
Medium
- Confidence
- 95% confidence
- Finding
- The example `intext:password filetype:txt` is a classic credential-discovery query pattern that can help users locate exposed passwords or secrets. Even in documentation, normalizing this query lowers the barrier for opportunistic reconnaissance against accidentally exposed sensitive data.
Missing User Warnings
Medium
- Confidence
- 93% confidence
- Finding
- The document repeatedly instructs `web_fetch` calls to third-party search providers without warning that user queries, IP address, user agent, and timing metadata may be disclosed externally. In an agent setting, users may assume local processing and unknowingly transmit sensitive research topics, credentials-related searches, or proprietary terms to external services.
Context-Inappropriate Capability
Medium
- Confidence
- 93% confidence
- Finding
- The manifest describes a multi-search-engine integration focused on web search features, filters, operators, privacy engines, and WolframAlpha queries. These documented capabilities use DuckDuckGo as a utility backend for data transformation and artifact generation rather than search, which is not clearly justified by the stated purpose.
Missing User Warnings
Low
- Confidence
- 89% confidence
- Finding
- The examples instruct users to send search queries directly to third-party search engines via web_fetch without warning that the query contents will be disclosed to external providers. In a skill centered on multi-engine search, this creates a real privacy/transparency issue because users may paste sensitive terms, internal URLs, or identifiers into example queries assuming the skill is self-contained.
Natural-Language Policy Violations
Low
- Confidence
- 88% confidence
- Finding
- A language/locale policy issue can arise when a skill forces a single language without user opt-in. This file presents all instructions and guidance solely in Chinese and does not indicate that the skill is specifically intended for Chinese-speaking users or offer an alternative language option.
Missing User Warnings
Low
- Confidence
- 87% confidence
- Finding
- The guide documents parameters that disable SafeSearch/family filtering (`kp=-1`, `nj=0`) without any caution about unsafe, explicit, or otherwise inappropriate results. In an automated agent context, this can expand exposure to harmful content and defeat downstream safety expectations for users or enterprise deployments.
Context-Inappropriate Capability
Low
- Confidence
- 85% confidence
- Finding
- The skill manifest presents the skill as a multi-search-engine integration guide, but this guidance extends into operational anonymity tooling by recommending Tor and onion services. That advice introduces a privacy/anonymity capability outside the declared search-integration purpose.
Static analysis
No suspicious patterns detected.