Everything 本地搜索

• Outcome: Review
• Latest audit: Jul 31, 2026 · 4:03 AM UTC
• Version: 1.0.0

Overview

This appears to be a real local search helper, but it deserves review because it can search sensitive Codex conversation logs and broad local file paths while loading native DLLs.

Install only if you intentionally want an agent to search your Windows Everything index and Codex conversation logs. Avoid custom DLL overrides unless you fully trust the file, and treat Codex log searches as sensitive because they may expose prompts, secrets, file paths, and prior work history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly describes reading local files, extracting and caching a DLL payload, consulting environment variables, and later reading candidate JSONL logs. Those are real capabilities, but the metadata shown here does not declare corresponding permissions, which weakens reviewability and user consent and can enable unexpected access to local data. In this context the capability is aligned with the stated purpose, so the issue is under-declaration rather than clearly malicious behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The bundled DLL’s exported symbols clearly include non-search capabilities such as database rebuild/save and run-history mutation functions, which exceed the skill’s stated search-only purpose. Even if these APIs are inherited from the upstream Everything SDK, shipping them inside a skill increases the reachable attack surface and creates an opportunity for destructive or privacy-impacting misuse if the wrapper ever invokes them or exposes arbitrary symbol access.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The embedded DLL exports functions such as deleting or saving run history, which are unrelated to locating files and could alter forensic evidence or user activity records. In the context of a search skill that may access Codex conversation logs and local file paths, unjustified history-mutation capability is especially concerning because it enables concealment of prior searches or tampering with user-visible history.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default prompt authorizes very broad local file and folder searches with minimal trigger constraints, which can cause the agent to access sensitive paths based on ordinary-language requests. In this skill's context, the risk is amplified because the same prompt also references Codex history logs, making it easier to pivot from generic file discovery into sensitive data retrieval.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code loads a native DLL from a user-supplied CLI argument, an environment variable, and fallback filesystem locations without verifying the DLL's authenticity unless the bundled payload path is used. Because loading a malicious DLL results in arbitrary native code execution in the Python process, any attacker who can influence those paths or social-engineer a user into supplying one can achieve full code execution with the user's privileges.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill explicitly advertises searching local Codex session JSONL logs and returning matching full paths, which can expose sensitive conversation history, prompts, secrets, and user-provided data through simple natural-language requests. This is especially dangerous because the feature is presented as a normal use case rather than a tightly controlled forensic or admin-only function, lowering the barrier to exfiltrating sensitive local history.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.