Signal-Search

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:57 AM UTC
• Version: 0.1.1

Overview

This appears to be a real search and research skill, but it includes anti-bot evasion, automatic environment-token use, and local caching behavior that should be reviewed before installation.

Install only if you are comfortable with a retrieval skill that performs live web fetching, may use local environment tokens when present, can cache fetched content locally, and includes documented anti-bot evasion techniques. Review configuration before use, especially cache settings, proxies, keyed providers, GITHUB_TOKEN, and any private/internal knowledge-base sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (318)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd += ["-x", proxy]
    cmd += [url]
    try:
        out = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: out = subprocess.run( cmd, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout + 5,

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

("调研 agentic search 前沿方案与开源实现", "L3"),
    ]
    for q, exp_tier in cases:
        res = __import__("orchestrate").retrieve(q, {}, cfg=cfg)
        assert set(
            [
                "findings",

• Confidence: 75% confidence
• Finding: res = __import__("orchestrate").retrieve(q, {}, cfg=cfg)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest and README position the skill as an embeddable retrieval primitive whose LLM, fetching, and bibliographic access are injected by the caller. However, later sections document internal built-in clean sources, direct HTTP access to 61+ sources, and activation of keyed APIs via environment variables, which is broader than 'just use injected capabilities' and contradicts the narrow framing.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The README explicitly contrasts the project with products that 'spawn agent' and says the library itself does not do so. But subsequent usage and module-map sections describe `research()` with '派 agent' and `agent_fn=` injection for sub-agent dispatch, which is an active contradiction in the documented intent versus described behavior.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The manifest describes a clean retrieval primitive for research and fact-checking, but this file frames 'directly hitting hidden JSON APIs' to 'bypass heavy anti-scraping' as a first-priority capability. That is a materially different operational goal from ordinary search/enhanced retrieval and expands the skill into anti-protection circumvention.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: These lines prescribe TLS/JA3/JA4 alignment, residential/mobile proxy rotation, stealth headless patches, and CAPTCHA-handling tactics. Such evasion capabilities are not an obvious requirement for a skill whose purpose is to search, compare sources, and produce weighted answers; they are specialized anti-detection features beyond normal retrieval.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Persisting cookies locally to reuse values such as 'cf_clearance' is a stateful anti-challenge mechanism, not a necessary part of the manifest’s described answer-quality retrieval behavior. It introduces durable local session handling oriented toward bypass continuity rather than ordinary search output quality.

Intent-Code Divergence

High

• Confidence: 91% confidence
• Finding: This line asserts ethical guardrails such as respecting robots.txt and avoiding abusive behavior, yet other sections instruct implementers to evade WAF presence, impersonate browser TLS/device fingerprints, and render through challenges. Those instructions undermine the stated compliance posture and create an active documentation-level contradiction about the intended operational boundaries.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module docstring says the library does not hardcode any API URL, implying endpoint configuration is left entirely to the caller. In reality, the code defines a fixed arXiv API endpoint and later constructs a fixed arXiv search-page URL for fallback fetching, which directly contradicts that documentation.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest describes the skill as a keyless, embeddable search/enhanced-retrieval primitive for clean external sources, with caller-injected LLM/fetching. This block explicitly adds configuration-driven ingestion of private or internal knowledge bases ("私有 / 内部" and "private_kb"), which is a materially broader capability than the manifest’s public-source research/fact-check framing.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The manifest emphasizes "零 key" and describes a retrieval primitive that should work without keys, but this helper injects {token} from environment variables into outbound URLs for configured sources. Even if optional, credential handling is an additional capability not justified by the stated zero-key scope.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest repeatedly positions the skill as "零 key" and focused on keyless clean retrieval, but the registry ships first-class definitions for Tavily, Exa, Perplexity, and Brave Search API with key_env-based activation. That is broader behavior than the advertised zero-key-only design, even if disabled by default.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This logic enables sources whenever matching API keys are present in injected keys or process environment variables. For a skill described as zero-key, embeddable clean retrieval, automatic credential-based capability expansion is not an obvious requirement and broadens operational scope.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The near_dup docstring states that the Jaccard secondary fallback runs only on candidates from the same LSH bucket, implying a constrained candidate set and near-O(n) behavior. However, the code at L79-L82 iterates over range(len(seen_sim)), comparing against all previously seen items, which contradicts the documented intent and complexity claim.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The module docstring explicitly states that it forces use of a system curl subprocess to work around JA3/TLS-based blocking. While network retrieval is expected for a search/research skill, spawning a system subprocess to evade anti-bot controls is a materially different capability than ordinary retrieval and is not disclosed in the manifest's purpose statement.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The comment describes a fallback that fetches the Eastmoney F10 page for the target security, implying a correct exchange-specific code should be constructed. However, the code uses `{'S' if code[0] in '69' else 'SZ'}` in both the fetch URL and returned URL, which diverges from the surrounding intent and from the conventional `SH`/`SZ` exchange coding used elsewhere in the file.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The research() docstring states "库内不内置任何书目源、不读环境变量" for the DOI resolver path, then later documents that GitHub access falls back to env GITHUB_TOKEN. That is an active contradiction within the function documentation's intent framing: the module presents itself as avoiding environment-variable reads while also advertising env-based credential fallback behavior.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The manifest describes the skill as '零 key' and as a clean embedded retrieval primitive. In code, research() explicitly exposes a github_token capability and documents fallback to env GITHUB_TOKEN for GitHub-source retrieval, which goes beyond a strict no-key/no-credential posture claimed at the manifest level.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The inline comment says the L3 check covers words including “学术/论文”, but the actual `L3_WORDS` list defined earlier omits “学术”. This is a direct documentation-to-code contradiction about routing behavior, which could mislead maintainers about how queries are classified.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest describes Signal-Search as a retrieval/enhancement skill that returns weighted, source-anchored answers and can be embedded as a primitive by callers. In this file, the skill creates on-disk research vault directories and multiple persisted artifacts such as INDEX.md, outline.md, report.md, citation files, and state files, which is a broader document-retention/export behavior than simply producing a clean answer.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The top-level documentation states that '.state.json' contains only cursor and dedup-set information to keep the vault clean. However, load_state and save_state operate on an unrestricted state dictionary and serialize whatever keys the caller provides, so the documented constraint is not enforced by code.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire skill description and usage guidance are written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The '何时用' section says to use the skill when a user wants to '搜信息、做调研、对比、查资料' or whenever another skill needs retrieval. These are very broad, common intents and the file does not provide negative examples or crisp boundaries for when this skill should not activate, which could lead to unintended invocation overlap with many general-purpose assistant tasks.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The manifest description is written as a Chinese-only operational description and presents the skill behavior in Chinese without offering any language or locale choice. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless clearly documented as region-specific, which is not stated here.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/scrape.py:239