Security audit

联网搜索助手

Security checks for vulnerabilities and agentic risk

Overview

This search skill mostly matches its stated purpose, but it asks for broad command and file-write capabilities that are not clearly needed for a free search-only assistant.

Review this skill before installing. It appears to be a search helper, but it requests shell and write capabilities that are broader than needed for basic search. Use it only in an environment where command execution and file changes are constrained, or ask the publisher for a search-only version without write access and with a concrete command whitelist.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a simple search assistant, but later claims generic file handling, API integration, and command execution capabilities. This mismatch can mislead users and orchestrators into granting broader privileges than necessary, increasing the risk of unintended file or shell actions under a low-risk facade.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The metadata/tools section includes write capability even though the free version explicitly states that export and history saving are unsupported. Exposing write access beyond stated functionality violates least privilege and creates an unnecessary path for data persistence, file tampering, or unauthorized output generation.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill repeatedly states that export/history are unsupported, yet also instructs the agent to use input_params for create/query/export operations. Contradictory instructions make agent behavior unpredictable and can be abused to justify unintended data export or state-changing actions that users would not expect from a free search-only tool.

Intent-Code Divergence

Low

Confidence: 94% confidence
Finding: A search assistant claiming broad core functions like file writing and command execution materially expands its operational scope beyond information retrieval. In context, this is dangerous because the skill's benign search branding may cause users or platforms to approve capabilities that can alter files or run shell commands.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: Broad trigger phrases such as common everyday requests can cause the skill to activate unintentionally. In a skill with network and possible exec/write-adjacent behavior, accidental invocation may leak queries externally or initiate actions the user did not knowingly request.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill references external APIs, command execution, and file writes without clearly warning users that routine use may involve shell access, network calls, or filesystem changes. Lack of transparent disclosure undermines informed consent and can lead to surprising, risky side effects during ordinary search tasks.

Static analysis

No suspicious patterns detected.