谷歌搜索(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.3

Overview

This search skill is mostly purpose-aligned, but its setup instructions include unsafe remote and unpinned dependency installation commands that deserve review before use.

Install only if you are comfortable with browser automation and local dependency setup. Prefer Node.js over the Bun pipe-to-shell command, pin Playwright versions where possible, run installs in an isolated project environment, and choose export paths carefully because searches and result URLs may be saved locally.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:334

Finding

Remote Bun Installer Downloaded and Executed Without Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:203

Finding

Unpinned Playwright and Chromium Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The documentation recommends curl -fsSL https://bun.sh/install | bash, which executes a remote script directly in the shell without prior verification or pinning. In a skill that encourages command execution and environment setup, this meaningfully increases supply-chain risk: a compromised upstream endpoint, MITM in a misconfigured environment, or changed install script could lead to arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

md

| 依赖项 | 类型 | 是否必需 | 获取方式 |
|:-------|:-----|:---------|:---------|
| Node.js 16+ | 运行时 | 二选一 | 官网下载安装 |
| Bun 1.0+ | 运行时 | 二选一 | `curl -fsSL https://bun.sh/install \| bash` |
| Playwright | npm包 | 必需 | `npm install playwright` |
| Chromium | 浏览器 | 必需 | `npx playwright install chromium` |
| Python 3.8+ | 运行时 | 可选 | 辅助脚本使用 |

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level description at L004 and metadata summary at L011 state that the skill provides '基础摘要生成'. Later, the capability matrix explicitly says 'AI摘要 | 不支持（需专业版）' at L047, which is a direct contradiction in the skill's own documentation about whether summarization is available.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The capability matrix says '批量搜索 | 不支持（需专业版）' at L046, and the FAQ repeats that the free version can only search one query at a time at L317-L318. However, the research scenario loops over multiple queries and aggregates results at L154-L166, which documents batch-style usage despite the stated limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises result export and includes write in its tool list, but does not define safe output locations, overwrite protections, or user confirmation requirements. In an agent context, that can lead to unintended modification of local files, clobbering existing content, or writing sensitive search results to unsafe paths if later instructions incorporate user-controlled filenames.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest and main description focus on browser-automated Google search, parsing, filtering, export, and lightweight summaries. The later '核心功能' section expands this into generic '文件处理', 'API集成', and sandboxed command execution capabilities, which are not justified by the stated search-specific purpose and describe a broader tool than the manifest claims.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

SQP-3 covers natural-language policy issues in any file type. The content consistently forces a single language locale for headings, comments, docstrings, and user-facing output, with no opt-in or explanation that the skill is meant only for Chinese-speaking users or a China-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explicitly says '支持中文交互', and the examples/configuration consistently default to Chinese locale and language without presenting this as an opt-in or offering alternatives. The policy allows locale constraints only when choice or justification is explicit; here the language expectation appears imposed rather than optional.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Several sections state that the free version requires no API key and works without applying for one, such as L032-L035 and L308-L309. But the dependency table lists 'LLM API | 必需' at L338, creating conflicting guidance about whether an external API dependency is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This is a markdown file, so SQP-2 applies to the skill description content. The examples export full search results, including query text and URLs, into JSON/CSV/Markdown files, but the surrounding documentation does not warn users that running these examples will persist potentially sensitive search data locally.

Content

No source excerpt is available for this finding.