Security audit

Multi Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is a search aggregator, but it misleadingly says searches stay local even though user queries are sent to third-party search engines.

Review before installing. Treat every search term as data sent to one or more external search engines, and avoid entering secrets, credentials, customer data, private document text, internal hostnames, or sensitive investigation terms. Ask the agent to identify the selected engines and get confirmation before multi-engine searches, especially for sensitive queries.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

Location: SKILL.md:157
Finding: Misleading Privacy Disclosure for External Search-Query Transmission
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims there is 'no external data transmission' and 'no personal data' handling, but its documented workflow and examples explicitly send user queries to multiple third-party search engines. This is a material privacy misrepresentation because search queries can contain personal, confidential, or sensitive information, and users are not clearly warned that their input will be transmitted externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The safety/privacy section explicitly states there is no external data transmission, which is directly contradicted by the use of web_fetch to query third-party search engines. Because queries can include personal or confidential content, this false statement can cause users to share sensitive information under incorrect assumptions about privacy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description emphasizes search aggregation and operational details but does not clearly disclose up front that user queries will be sent to multiple external search engines. This omission weakens informed consent and can mislead users about where their data goes, particularly when combined with later contradictory privacy claims.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill automatically routes queries to domestic or international engines based on language without offering the user a choice or consent. This can unexpectedly disclose queries to providers in different jurisdictions, creating privacy, compliance, and user-expectation risks, especially for sensitive searches.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The metadata description forces a specific language/locale in natural-language content, which can violate organizational language-choice policies when no opt-in or alternative is provided. There is no indication that this skill is intentionally region-specific or that users can select another language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide encourages sending potentially sensitive queries such as IP addresses and cached/deleted-page lookups to third-party search providers without warning users that the query contents will be transmitted and logged externally. In a reusable agent skill, this can lead to inadvertent privacy leakage, especially if users adapt the examples for internal hosts, incident-response artifacts, or confidential investigation terms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file documents kp=-1 as '关闭安全搜索' for DuckDuckGo, and later nj=0 as '关闭 family filter' for Startpage, but provides no warning that these settings may expose users to adult or otherwise unsafe content. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user safety or privacy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This manifest/config file defines multiple engines with fixed region values such as "cn" and "global", which imposes locale behavior in the skill configuration. Because the file provides no indication of user-selectable locale preferences or opt-in, it may violate the policy against forcing a specific language/locale without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: SQP-3 applies to natural-language policy issues in any file type. The document fixes the skill content to a specific language/locale context without any opt-in or alternative, which can violate organizational language/locale choice expectations unless explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The examples directly invoke web_fetch against third-party search engines using raw query strings, which can expose user-entered search terms to external providers without any privacy notice or consent flow. In a search skill, this is expected functionality, but it still creates a real privacy risk because sensitive queries may be transmitted off-platform and logged by those providers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The document broadly recommends multiple external providers and repeated web_fetch usage without disclosing that user queries will be shared with third parties across different jurisdictions and privacy models. While this is aligned with the skill's purpose, the missing disclosure can mislead users into assuming searches remain local to the agent environment.
Content: No source excerpt is available for this finding.