谷歌搜索(专业版)

• Outcome: Review
• Latest audit: Aug 29, 2026 · 4:39 AM UTC
• Version: 1.0.1

Overview

This Google-search skill is mostly aligned with its purpose, but it asks for broad execution authority while under-scoping third-party alerts, local caching, monitoring, and installation risk.

Review this skill before installing. Use it only for intended search workflows, avoid sensitive or confidential queries unless you are comfortable sending them to Google, LLM providers, proxies, and configured webhooks, and prefer safer manual/package-manager installation over piping remote scripts into a shell. If you enable monitoring or caching, choose non-sensitive keywords, control webhook destinations, and periodically purge cached results.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The skill's invocation guidance is extremely broad, including generic AI-model, agent orchestration, and LLM-application use cases without tight triggers. In an MD+EXEC skill with read/exec/glob/grep permissions, overbroad routing increases the chance the agent invokes this skill in inappropriate contexts, causing unnecessary command execution, network access, or data handling beyond user intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill describes use of browser automation, LLM summarization, webhooks, proxies, and external services, but it does not clearly warn users that their queries, monitored keywords, search results, and alert payloads may be transmitted to third parties. In a search-and-monitoring skill, that omission can lead to unintentional disclosure of sensitive business terms, investigations, or internal monitoring topics.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The example sends monitored keyword-change alerts to a webhook without any warning that search terms and derived intelligence may be transmitted to a third-party service. In a search-monitoring skill, keywords may contain sensitive business terms, internal investigations, or personal data, so silent exfiltration to Slack or similar services creates a real confidentiality risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The cache example persists queries and search results to local disk without warning users that potentially sensitive searches and retrieved content will be stored in plaintext JSON. In this skill context, search queries may reveal proprietary interests, personal research, or monitored entities, and local storage increases exposure to other local users, backups, or later unintended reuse.

External Script Fetching

High

• Category: Supply Chain

Content

| 依赖项 | 类型 | 是否必需 | 获取方式 |
|---:|---:|---:|---:|
| Node.js 16+ | 运行时 | 二选一 | 官网下载安装 |
| Bun 1.0+ | 运行时 | 二选一 | `curl -fsSL https://bun.sh/install \| bash` |
| Playwright | npm包 | 必需 | `npm install playwright` |
| Chromium | 浏览器 | 必需 | `npx playwright install chromium` |
| Python 3.8+ | 运行时 | 必需 | 官网下载安装 |

• Confidence: 97% confidence
• Finding: The skill instructs users to execute a remote script directly with 'curl ... | bash', which bypasses review and grants the fetched content immediate shell execution. If the remote source, transport, or distribution path is compromised, this can result in arbitrary code execution on the host running the skill setup.

Static analysis

No suspicious patterns detected.