Security audit

Signal-Search

Security checks for vulnerabilities and agentic risk

Overview

Signal-Search mostly matches its search/research purpose, but it needs Review because its default retrieval path can fetch unvalidated URLs and its private-source token handling can expose credentials.

Review before installing in any environment with access to internal networks, cloud metadata services, or sensitive private APIs. Prefer outbound network restrictions, avoid putting tokens in URL templates, pin dependencies in a dedicated environment, and do not pass a tool-capable LLM directly into the conflict-check callback without prompt-injection defenses. Be aware that fetched content may be cached unless disabled.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/extract.py:142
Finding: Server-Side Request Forgery Through Unvalidated Search Result and Redirect URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/clean_sources.py:1431
Finding: Environment-Derived API Secrets Can Be Embedded in Request URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: examples/conflict_llm.py:47
Finding: Untrusted Retrieved Content Is Concatenated into an LLM Instruction Prompt
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:188
Finding: Runtime Dependencies Are Installed Without Version or Hash Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (233)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 声明描述的是一个较完整的增强检索/事实核查答案层 skill，重点在检索、调研、信源比对后生成结构化答案。代码却只是 examples/conflict_llm.py，一个供 research() 注入使用的冲突检测函数工厂。它接收 query 和已有 evidence，构造 prompt 调用外部注入的 LLM，解析返回的 conflicts 列表；没有任何搜索、抓取、排序、来源整合、分层回答或预算管理逻辑。虽然它与事实核查场景相关，且提到 M51 语义冲突检测，但仅覆盖声明中很窄的一部分，且主要用途明显不同，因此属于实质性描述不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a retrieval/answering skill whose purpose is to search, compare sources, fact-check, and return polished answers with specific scoring/anchoring/depth-budget semantics. The supplied code does not implement that behavior. Instead, it is an example smoke-test script for validating two retrieval backends under real network conditions and confirming fallback behavior when the primary transport fails. It imports finance/academic/scrape modules, performs live fetches, monkeypatches scrape._fetch_system_curl to force 403 errors, injects fallback shims, and prints diagnostic results. While this is related to retrieval infrastructure, its primary purpose is testing transport and fallback wiring, not serving as the described embedded search/answer primitive. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for a general-purpose retrieval and answer synthesis skill that returns weighted, source-anchored, layered answers under token budgets. The supplied code does not implement that behavior. Instead, it is an example verification script focused on two narrow checks: ensuring arXiv search results do not fabricate DOI values when an API key is absent, and confirming that a local BibTeX export helper emits @article when a real DOI is present. It prints diagnostics and asserts export correctness; it does not perform answer construction, SBA scoring, M51 fact anchoring, layered depth handling, token budgeting, or clean embedded retrieval output as described. This is a materially different primary purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个高层的增强检索/答案生成能力，强调结果整合、评分、来源锚定和预算控制；但代码只是一个低层 arXiv 专用数据源适配器。其主要功能是通过 curl 请求 arXiv API，解析论文标题、摘要、作者、发布日期等元数据，并可选地由调用方提供 DOI 解析器补充 citation.doi。没有看到任何对多来源信息的比对、事实核查、加权排序解释、分层答案组织或 token 控制逻辑。虽然声明中提到‘由调用方注入 LLM 与抓取能力’，与代码中 web_fetch/doi_resolver 注入模式有一点形式上的相似，但核心产品目的和输出形态明显不同，因此属于实质性描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a retrieval/fact-checking skill focused on producing weighted, source-anchored research answers. The actual code chunk does not perform retrieval, ranking, source comparison, source anchoring, fact verification, token budgeting, or answer generation. Instead, it is a support utility for persistent on-disk caching using JSON files and TTL expiration. While caching could be a supporting implementation detail inside a larger retrieval system, this specific chunk’s primary behavior is materially different from the declared purpose and introduces filesystem storage behavior that is not disclosed in the description. Therefore this code chunk does not accurately represent the declared skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared description presents this as an answer-level retrieval enhancement skill that outputs synthesized, scored, source-anchored answers. The supplied code is lower-level infrastructure: a source catalog plus retrieval provider that fans out a query across many engines/APIs, parses results, deduplicates URLs, and returns docs. The comments explicitly say it is a provider merged into a quality layer by another orchestrator, not a replacement for answer generation. Also, although many sources are keyless, the registry includes multiple keyed sources (Tavily, Exa, Perplexity, Brave API) and custom sources can also be keyed via env vars, which conflicts with the “零 key” claim as stated. The code additionally supports private/custom knowledge base connectors, an undeclared capability. The embeddable/caller-injected aspects do align, but the primary purpose and capability surface are materially different from the declared answer-producing behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 这是明显不匹配。声明描述的是一个面向信息检索与答案增强的高层 skill，而给出的代码仅是底层公共工具库 common.py。其主要行为是读取配置文件、处理 URL 域名、做多语种 tokenization，以及维护 TTL 缓存。这些可以作为检索系统的支撑组件，但它们本身不构成所宣称的核心功能。尤其是代码中完全看不到搜索、网页抓取、来源比较、事实核查、答案清洗、分层深度控制、打分或来源锚定逻辑。另一个差异是代码会访问本地 config.json，这属于声明中未体现的资源访问行为。按照“主目的 materially different”与“undeclared capability/resource access”标准，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a high-level retrieval-and-answering skill used for research and fact checking, with specific output features such as weighted scoring, source anchoring, layered depth, and token-budget control. The supplied code chunk, however, is a standalone deduplication utility. It tokenizes text, computes simhash fingerprints, uses 4-block LSH to find candidate near-duplicates, checks Hamming distance, falls back to Jaccard similarity, and removes duplicate URLs/documents while preserving order. This may be a supporting component inside a larger retrieval pipeline, but by itself it does not implement the described skill’s primary purpose or advertised capabilities. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared description presents a higher-level answer-quality retrieval/enhancement skill that outputs polished answers with scoring, source anchoring, depth controls, and token budgeting. The supplied code chunk is much narrower and lower-level: it resolves SERP results to landing pages, fetches/extracts content, uses caching, and returns normalized source documents. That behavior is related to retrieval, so there is thematic overlap, but the core advertised user-visible capabilities are absent in this code. The code is effectively a deep-fetch source acquisition module rather than the described answer-producing research skill. Therefore the description does not accurately represent what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个生产用途的“检索/增强检索 skill”，核心职责应是执行搜索、信源比对、事实核查并输出带来源锚定和分层深度的答案。实际代码却是 scripts/eval.py，一个评估与实验脚本：它加载 references/eval-golden-set.md，调用 route.classify_tier 评估档位命中率；在 live 模式下调用 orchestrate.retrieve 收集 tier_used、confidence、sources 数量、token_used、verify_issues、UNCERTAIN 数等评测指标。虽然 live 模式间接触达检索函数，但该代码的主要目的明显是“评估检索系统表现”，不是“实现检索 skill 本身”。因此存在实质性描述-行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad retrieval/answer-enhancement skill that synthesizes clean answers with scoring, source anchoring, layered depth, and token budgeting, intended as a reusable retrieval primitive. The code instead implements a narrow financial data source adapter for 东方财富 (Eastmoney): it parses stock identifiers, calls specific market-data and report endpoints, formats quote/K-line/fund-flow/report documents, and optionally falls back to webpage fetching. While comments mention entering a quality layer with M51/SBA, the code itself does not perform the described answer-layer synthesis, layered-depth control, or token-budget enforcement. Its primary purpose and accessed resources are materially more specific than declared, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个面向多类信息检索与事实核查的上层答案增强组件，核心产物应是“干净答案”并附带评分、来源锚定、分层深度和预算控制。实际代码却只是 GitHub 数据源适配器/连接器，专门搜索开源仓库，返回结构化搜索结果列表及警告信息。两者在主要目的、输出形式和能力范围上都有实质差异：声明强调答案后处理与质量控制，代码仅做源检索；声明是通用检索原语，代码则绑定 GitHub 这一单一资源。因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description presents a higher-level retrieval augmentation skill that searches, researches, compares sources, and returns structured, source-anchored answers. The supplied code chunk is much narrower: it is a supporting reranker that reorders already-retrieved candidates using lexical and optional semantic similarity. While reranking can be a supporting part of retrieval enhancement, the primary declared behavior emphasizes end-to-end answer production and evidence handling features that are absent here. No undeclared sensitive resource access appears, but the actual behavior is materially narrower and different in purpose from the declared skill description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a retrieval/research skill whose core purpose is to search, compare sources, fact-check, and produce a structured clean answer with specific scoring and source-anchoring properties. The supplied code chunk does not implement those behaviors directly. Instead, it provides two wrappers around another module's research() function: one interactive CLI function that pauses for user confirmation after generating an outline, and one non-interactive SDK function that emits progress events. This is a materially different primary purpose for the code chunk itself: orchestration and interaction, not retrieval/answer enhancement. Additionally, the code introduces undeclared capabilities such as reading from stdin, cancellation based on operator input, and progress callback/event emission. While it may support a larger research system indirectly via the underlying _research module, this chunk by itself does not accurately match the declared skill description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a retrieval skill whose main job is to search for information and produce enhanced answers with scoring, source anchoring, layered depth, and budget control. The provided code chunk does none of that retrieval or answer-generation work. Instead, it is a router: it classifies query depth tiers (L0–L3), supports explicit '/signal L3' overrides, uses a routing-memory cache for exact query matches, and determines whether search should be skipped for greetings, self-description questions, or vague queries lacking searchable entities. While tiering can be a supporting component of the described system, this code chunk by itself materially differs from the declared purpose because its actual behavior is routing/gating logic, including an undeclared 'do not search' decision function, not the described search/research/answer-enhancement capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 这是明显的不匹配。声明把该 skill 描述成面向上层的“答案质量层搜索/增强检索”组件，重点在检索后答案组织、评分、来源锚定和预算控制；但给出的代码块仅是 scripts/scrape.py，其职责是网页抓取与反爬处理。它包含 UA 伪装、requests/curl_cffi/system curl 回落、代理、节流、robots 检查、挑战页检测、登录墙跳过、指数退避、域名冷却、TLS 校验开关、PII 正则脱敏等，输出也是 (html_or_None, info)。这些能力可被上层检索系统作为支撑组件使用，但就该代码块本身而言，并没有实现声明中最核心的“增强答案输出”行为，反而新增了未在描述中体现的网络采集/反爬执行能力。因此应判定为描述与实际行为不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a higher-level research/retrieval skill that produces enhanced final answers with specific analysis features and formatting guarantees. The supplied code does something materially narrower: it is only a transport/parser connector for SearXNG search results. While this can support a retrieval pipeline, the code chunk itself does not perform the advertised answer enhancement behaviors. There is no evidence of source comparison logic, fact-checking logic, weighted ranking beyond truncating max_results, source anchoring, layered output construction, or token-budget management. No harmful undeclared capability is present; the mismatch is that the description significantly overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill performs retrieval and answer enhancement functions such as searching, source comparison, fact anchoring, scoring, and controlled-answer generation. However, the provided code does none of that. It only creates a Trace class for collecting events, assigning a run ID, optionally creating a log directory, writing JSONL trace records to disk, and returning an in-memory snapshot. This is a materially different primary purpose: observability/logging rather than retrieval or research. The file system access for log writing is also inconsistent with the declared zero-permission retrieval primitive description. This is not merely a supporting implementation detail because the entire supplied chunk is dedicated to tracing behavior, with no retrieval logic present.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a retrieval/answering primitive that searches, compares sources, performs fact-checking, and returns a clean synthesized answer with scoring/anchoring semantics. The supplied code does not implement search, retrieval enhancement, SBA scoring, M51 fact anchoring, depth control, token budgeting, or answer synthesis. Instead, it primarily manages on-disk storage of research artifacts and citation exports, including creating folders, writing markdown notes, rendering reports, and persisting machine state. While this could be a supporting component of a broader research system, its primary behavior is materially different from the declared skill purpose and adds undeclared filesystem persistence capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The declared description presents the skill primarily as a search/research and answer-enhancement retrieval primitive that gathers information and produces weighted, layered answers. The supplied code chunk does not perform retrieval, comparison, answer generation, SBA scoring, layered output construction, or token-budget enforcement. Instead, it performs post-hoc validation of findings against provided sources: URL citation checking, atomic fact extraction, heuristic/semantic source anchoring, polarity and numeric consistency checks, and uncertainty aggregation. While the description mentions fact-level source anchoring (M51), which aligns partially with this code, that is only one component. The primary behavior of this chunk is verification/guardrails, materially narrower and different from the declared retrieval-oriented purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a substantive search/research skill with specific output behavior and retrieval-related capabilities. The provided code chunk only adjusts sys.path in a test configuration file to support imports during testing. This is a development/testing setup detail and does not implement or meaningfully reflect the declared skill behavior. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the declared description and the supplied code. The description claims a search/retrieval augmentation skill with research-oriented answer synthesis features. However, the code only contains unit tests for a cache module's enabled/disabled behavior and missing-key handling. It does not implement or demonstrate any retrieval, ranking, source handling, fact verification, or answer formatting features described in the declaration. This is not merely a supporting detail; the code’s primary purpose is materially different and unrelated.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向增强检索与答案生成质量控制的 skill，核心能力应包括信息搜索、资料比对、来源锚定、评分和结构化答案输出。而代码片段并未体现任何检索、抓取、LLM 调用、答案生成、来源锚定或预算控制逻辑；它只是在测试一个去重模块 dedup.near_dup 的重复检测算法。去重可以是检索系统中的支持性细节，但这里给出的全部代码都集中在去重测试上，与声明的主要用途相差明显，因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: There is a meaningful description-to-code mismatch. The declared purpose describes a higher-level retrieval/answering skill that synthesizes research results into structured answers with scoring, source anchoring, depth tiers, and budget controls. However, the provided code chunk is only a test file covering parsing of search-result pages, redirect handling, landing-page scraping, fallback logic, caching, and concurrent resolution. Those behaviors support a retrieval stack, but they do not demonstrate the advertised end-user functionality. This is not merely an implementation detail gap: the primary observable purpose of the supplied code is validation of deep-fetch mechanics rather than answer-layer enhancement. Therefore the description overstates or misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a search/retrieval skill used to research information, compare sources, and produce structured grounded answers. The supplied code does not implement any of that behavior. It is only a test module that checks properties of an evaluation pipeline: loading a golden set and verifying a tier hit-rate metric. While tests may support development of such a skill, this chunk’s actual primary purpose is evaluation, not retrieval or answer enhancement. Therefore the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/scrape.py:239