Back to skill

Security audit

Web Search Plus

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed web search and URL extraction tool; it sends queries and URLs to configured providers and caches results locally, with no evidence of hidden or destructive behavior.

Install only if you are comfortable sending search queries and extraction URLs to the configured provider APIs. For sensitive work, choose a provider explicitly, prefer a self-hosted SearXNG instance where appropriate, avoid private/internal URLs unless you intentionally enable them, disable caching with WSP_DISABLE_CACHE=1 or --no-cache when needed, and keep config.json/API keys protected.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrase "search the web for" is extremely generic and likely to match ordinary user requests that were not intended to invoke this specific third-party search skill. In this skill’s context, accidental activation is more dangerous because it can automatically route user queries to multiple external providers and cache results locally, creating unintended data disclosure and unnecessary outbound network activity.

Vague Triggers

Low
Confidence
83% confidence
Finding
The URL-extraction triggers are somewhat ambiguous and may cause the skill to activate on routine requests involving links or summaries, even when the user did not intend to send a URL to an external extraction provider. In this package, that risk is amplified because supplied URLs are fetched by third-party infrastructure, so accidental activation can leak sensitive or internal URLs and trigger unwanted remote retrieval.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This file sends user-supplied URLs and extraction options to multiple third-party services (Keenable, Serper, Firecrawl, Linkup, Tavily, Exa, You) as the core behavior of the skill. Even though SSRF-style validation is present, the design still discloses potentially sensitive user targets and fetch parameters to external providers without any in-file consent, warning, or data-classification guard, creating a real privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Search queries and provider responses are cached to local disk automatically, including potentially sensitive user input and returned content, without any user-facing disclosure or explicit opt-in. In an agent/skill context, queries may contain secrets, internal project names, or investigative topics, so persistent storage materially increases privacy and data-retention risk.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The wizard collects multiple provider API keys and writes them to config.json in plaintext without setting restrictive filesystem permissions or warning the user about secret-handling risks. On multi-user systems, shared workspaces, backups, or misconfigured file permissions, those credentials could be exposed and then abused for unauthorized API usage or account impact.

External Transmission

Medium
Category
Data Exfiltration
Content
raise ValueError("Keenable requires an API key or an enabled public endpoint")


def extract_keenable(urls: List[str], api_key: Optional[str], output_format: str = "markdown", include_images: bool = False, include_raw_html: bool = False, render_js: bool = False, public_allowed: bool = False, api_url: str = "https://api.keenable.ai/v1/fetch", timeout: int = 30) -> Dict[str, Any]:
    del output_format, include_images, include_raw_html, render_js
    from urllib.parse import quote
    endpoint, headers = _keenable_endpoint(api_url, api_key, public_allowed)
Confidence
87% confidence
Finding
https://api.keenable.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
return {"provider": "serper", "results": results}


def extract_firecrawl(urls: List[str], api_key: str, output_format: str = "markdown", include_images: bool = False, include_raw_html: bool = False, render_js: bool = False, api_url: str = "https://api.firecrawl.dev/v2/scrape", timeout: int = 60) -> Dict[str, Any]:
    formats = ["html"] if output_format == "html" else ["markdown"]
    if include_raw_html and "html" not in formats:
        formats.append("html")
Confidence
87% confidence
Finding
https://api.firecrawl.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
return {"provider": "firecrawl", "results": results}


def extract_linkup(urls: List[str], api_key: str, output_format: str = "markdown", include_images: bool = False, include_raw_html: bool = False, render_js: bool = False, api_url: str = "https://api.linkup.so/v1/fetch", timeout: int = 30) -> Dict[str, Any]:
    results = []
    for url in urls:
        try:
Confidence
87% confidence
Finding
https://api.linkup.so/

External Transmission

Medium
Category
Data Exfiltration
Content
return {"provider": "linkup", "results": results}


def extract_tavily(urls: List[str], api_key: str, output_format: str = "markdown", include_images: bool = False, include_raw_html: bool = False, render_js: bool = False, api_url: str = "https://api.tavily.com/extract", timeout: int = 30) -> Dict[str, Any]:
    del output_format, include_raw_html, render_js
    data = request_json(api_url, {
        "method": "POST",
Confidence
88% confidence
Finding
https://api.tavily.com/

External Transmission

Medium
Category
Data Exfiltration
Content
return {"provider": "tavily", "results": results}


def extract_exa(urls: List[str], api_key: str, output_format: str = "markdown", include_images: bool = False, include_raw_html: bool = False, render_js: bool = False, api_url: str = "https://api.exa.ai/contents", timeout: int = 30) -> Dict[str, Any]:
    del output_format, include_raw_html, render_js
    data = request_json(api_url, {
        "method": "POST",
Confidence
87% confidence
Finding
https://api.exa.ai/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.