Security audit

Private Deep Search

Security checks across malware telemetry and agentic risk

Overview

The skill appears to do the advertised research work, but its strong privacy claims understate external query/page exposure and its Docker service may be more exposed and persistent than users expect.

Review before installing. Do not use it for secrets or highly sensitive research unless you are comfortable sending queries to upstream search engines and contacting result websites. Consider binding Docker to 127.0.0.1, using a VPN/Tor/proxy if appropriate, stopping the container when finished, and pinning the Docker image instead of using latest.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README strongly emphasizes privacy and 'forgets everything' behavior, but it does not clearly warn that deep research necessarily sends user queries to external search engines and fetches content from third-party websites. This can mislead users into believing their research remains fully local, when in reality their queries, IP/VPN exit IP, timing, and target-site access patterns are exposed to outside services.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill repeatedly markets itself as 'private,' 'local,' and 'logs nothing' without clearly disclosing that user queries are still sent to third-party search engines and that the deep-research flow fetches content from external websites. This can mislead users into entering sensitive prompts under a false assumption of full privacy, causing unintended disclosure of queries, URLs, metadata, and possibly IP-linked browsing activity to outside services.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The setup instructions tell users to run './setup.sh' and start Docker services, then state the service will be available on localhost:8888, but they do not warn about what the script changes, what containers are launched, or whether ports, volumes, and network access are exposed. This increases the chance that users execute privileged or network-reachable components without understanding the resulting system modifications or attack surface.

Vague Triggers

Low

Confidence: 86% confidence
Finding: The manifest exposes two network-capable skills but only gives broad descriptions like 'web search' and 'multi-iteration research with content scraping' without clear activation boundaries or task scope limits. Ambiguous invocation criteria can cause an agent to call these skills in situations the user did not intend, increasing the chance of unnecessary external requests or scraping behavior.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The manifest advertises web search and content scraping but does not warn users that prompts or derived queries may be sent over the network to external services. In an agent setting, missing disclosure of external data retrieval is dangerous because users may unknowingly expose sensitive information or assume operations are local and privacy-preserving when they are not.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code performs outbound requests to arbitrary third-party URLs returned by the search engine and downloads page content without any explicit user-facing disclosure or consent mechanism. In a research skill, user queries may be sensitive, and contacting external sites can reveal user interests, IP/VPN egress identity, timing, and access patterns to untrusted parties; the risk is elevated because the tool automatically follows search results at scale.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description says 'Use for any web search query,' which is broad enough to trigger this skill for essentially all general web-search requests. That can cause unintended invocation, unnecessary network access, and overexposure of user queries to the local SearXNG service and its upstream search engines. In context, this is somewhat mitigated by using a local privacy-focused instance, but it still creates overreach in routing and data handling.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.