zpw-mianfei-web

Use a local free search engine to find information on the web by fetching results with specified keywords.

Security Scan

The skill's declared purpose (querying a local search engine) matches the simple curl-based instructions, but the runtime instructions are vague and contain risks (hard-coded LAN IP and an unsanitized query substitution) that could enable leakage or command/SSRF-style abuse.

Purpose & Capability

Name/description claim a local search; the SKILL.md instructs the agent to extract a query and call a local search endpoint — this is consistent and proportional to the stated purpose.

Instruction Scope

The workflow tells the agent to run a shell curl against a hard-coded IP (http://192.168.199.100:8080/search?q={{query}}&format=json). It does not instruct URL-encoding or sanitization of {{query}}, nor how to safely invoke the command. Unsanitized substitution into a shell command can enable command injection or broken quoting. Also, the hard-coded LAN IP means user queries will be sent to that host — if that host is untrusted it may collect sensitive queries or enable SSRF-like access depending on agent network privileges.

Install Mechanism

Instruction-only skill with no install spec or downloaded code; nothing is written to disk by the skill itself (lowest install risk).

Credentials

No environment variables, credentials, or config paths are requested; requested resources are proportionate to the simple search purpose.

Persistence & Privilege

Skill is not always-enabled and uses default autonomous invocation settings. It does not request system-wide persistence or modify other skills.

What to consider before installing

This skill is small and its purpose matches its instructions, but exercise caution before installing. Questions to ask the author: what host is 192.168.199.100 and can you make the endpoint configurable (via an env var) rather than a hard-coded LAN IP? Ensure the agent URL-encodes or sanitizes the query before inserting it into a shell command, or better: use an HTTP client API rather than invoking a shell curl to avoid command injection. Do not send sensitive data (passwords, secrets, or private tokens) through this skill until you confirm the local server is trusted. If you run agents in an environment where that IP could reach internal services, understand the SSRF/data-leak risk. If you want this skill, request the author to: (1) make the endpoint configurable, (2) document input encoding/escaping, and (3) prefer non-shell HTTP calls so user input cannot break command quoting.

markdown

---

name: zpw-mianfei-web

description: 使用本地免费搜索引擎搜索网络

---

# 免费搜索技能

## When to Run

- 用户说“搜索”、“查一下”、“找找”

## Workflow

1. 提取搜索关键词

2. 执行命令：

```bash

curl -s 'http://192.168.199.100:8080/search?q={{query}}\&format=json'