Security audit

谷歌搜索工具

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a Google search helper rather than malware, but its documentation asks for broad command and file authority with inconsistent scope and credential handling.

Review this skill before installing. Use it only for non-sensitive public web searches, avoid putting confidential project names or secrets in queries, prefer environment or secret-manager configuration over a committed .env file, and be cautious granting broad exec/write authority because the package does not include a bounded implementation script.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest advertises a narrowly scoped Google CSE search tool, but later documentation broadens it into generic file processing, API integration, and command execution. This scope drift is dangerous because agents may grant or exercise read/write/exec capabilities well beyond user expectations, enabling unintended local actions or abuse under the guise of a simple search skill.

Intent-Code Divergence

Medium

Confidence: 78% confidence
Finding: The skill documentation contains contradictory statements about supported versus unsupported features, including repeated references to create/query/export operations despite the free-version table saying export and several advanced capabilities are unsupported. Such inconsistencies can mislead an agent or user into invoking behaviors the tool should not perform, increasing the chance of unsafe fallback logic or over-privileged execution.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The skill advises against exposing secrets, yet its setup instructions explicitly create a .env file containing API credentials. In agent or shared-workspace contexts, writing secrets to disk can leak them through source control, logs, backups, or later file reads by other tools.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger condition covers broad SEO- and traffic-related scenarios rather than narrowly defining when this specific search skill should run. Overbroad invocation criteria can cause the agent to call the skill in unrelated contexts, increasing unnecessary data sharing to external APIs and accidental use of exec-enabled workflows.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation does not clearly warn users that search queries and associated metadata will be transmitted to Google APIs. This creates a privacy and compliance risk because users may unknowingly send sensitive research terms, internal project names, or other confidential data to a third party.

Static analysis

No suspicious patterns detected.