联网搜索助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.3

Overview

This search skill is not clearly malicious, but it asks for broad command, read, and write authority that is not well scoped for a simple web-search assistant.

Install only if you are comfortable granting this skill command execution and local file access in a tightly sandboxed environment. Prefer removing write access, narrowing command use to approved search/network diagnostics, and requiring explicit confirmation before any local file operation or system command.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:18

Finding

Excessive and Inconsistent Tool Permissions for a Search-Only Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 18-21
Vulnerability Type: Excessive tool permissions and inconsistent access-control declarations
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

Technical Analysis

The skill is presented as an Internet search and summarization assistant, but its manifest requests generic command execution and local file operations. These capabilities exceed the least-privilege requirements of a search-only workflow.

The two permission declarations are also inconsistent: allowed-tools permits read and exec, while the separate tools list additionally declares write. Depending on which field the hosting agent prioritizes, the skill may receive write access despite that capability being absent from allowed-tools.

Generic exec access is particularly sensitive because it can provide indirect access to files, processes, environment variables, and network utilities available to the agent account. The document recommends sandboxing and command allowlisting, but it does not technically define or enforce either control.

Attack Path

1. A user or untrusted search result supplies content crafted to influence the agent's next tool call.
2. The skill processes that content while operating with exec, read, or potentially write permission.
3. The agent invokes an overly broad tool instead of a dedicated search interface.
4. Depending on host enforcement and sandbox configuration, the invocation reads local files, executes operating-system commands, or modifies files accessible to the agent account.
5. Retrieved local information could subsequently appear in generated output or be transmitted through an available network channel.

This path is conditional on the host granting the declared tools and failing to enforce an independent command allowlist or sandbox boun ...[truncated 724 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, read, and write unless a concrete search operation strictly requires them.
2. Replace generic command execution with a dedicated, narrowly scoped web-search or HTTP API tool.
3. Maintain one authoritative permission declaration and ensure all manifest fields specify the same minimal tool set.
4. If command execution is unavoidable, enforce a host-side allowlist containing exact executable paths, fixed arguments, and strict time and resource limits.
5. Never concatenate user input, search queries, URLs, or search-result content into shell commands.
6. Run the skill in a sandbox with a read-only filesystem, an empty or filtered environment, no access to credentials, and network access limited to approved search endpoints.
7. Require explicit user confirmation before any local file access or state-changing operation.
8. Add automated manifest validation that rejects conflicting tool declarations.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:338

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 338
Vulnerability Type: Unpinned dependency installation from the active package index
Risk Level: Low

Vulnerable Code

bash

pip install requests

Technical Analysis

The documented installation command does not pin a reviewed package version, verify a package hash, or explicitly select a trusted package repository. Consequently, the installed artifact can vary over time and depends on the active Python package-index configuration.

The package name requests is a well-known legitimate dependency, and the installation is documented as optional. There is no evidence that this project intentionally references a malicious or misspelled package. Nevertheless, an unpinned installation creates a supply-chain risk if the configured package index, mirror, DNS path, or upstream release channel is compromised.

Python package installation may execute build hooks during source distribution processing. A malicious package artifact could therefore run code under the privileges of the user performing the installation.

Attack Path

1. An operator follows the documented pip install requests command.
2. The local pip configuration resolves packages through a compromised, malicious, or incorrectly prioritized package index or mirror.
3. Because no version or cryptographic hash is required, the resolver accepts an attacker-controlled artifact matching the requested package name and dependency constraints.
4. Package installation executes malicious build-time behavior or installs malicious runtime code.
5. The payload gains the privileges of the account running pip and can access that account's files, environment variables, and network connectivity.

Exploitation requires control of, or influence over, the selected package source or upstream artifact. The audited file itself does not retrieve or execute a specific malicious payload.

Impact Asse

...[truncated 474 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an audited version using an exact version constraint, such as requests==<reviewed-version>.
2. Store dependencies in a lock file or requirements file containing cryptographic hashes.
3. Install with hash enforcement, for example through pip install --require-hashes -r requirements.txt.
4. Explicitly configure an approved HTTPS package index and prevent untrusted supplemental indexes from taking precedence.
5. Prefer prebuilt, verified wheels and avoid source builds where operationally possible.
6. Install dependencies in an isolated virtual environment as an unprivileged user; never recommend administrator-level installation.
7. Regularly scan pinned dependencies for known vulnerabilities and update them through a reviewed process.
8. If requests is not actually required by the implementation, remove the installation recommendation entirely.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are common everyday expressions like '查一下', '搜索', and '帮我查', making accidental activation likely during unrelated conversations. When paired with exec/read/write-capable tooling, broad triggers can cause the skill to activate in contexts where the user did not intend to authorize tool use, increasing the chance of unwanted command execution or file access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A personal web search assistant does not need generic file processing and system command execution to fulfill its stated role. Advertising those broad capabilities in combination with exec materially increases attack surface, enabling misuse such as arbitrary local file access, shell command execution, or persistence if triggered by crafted prompts or ambiguous tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description explicitly states “支持中文交互,” and the configuration later sets “语言偏好 | 中文 | 优先中文结果,” but the document does not offer users a language choice or make this an opt-in preference. This creates a language/locale policy issue because the skill appears to default to a specific language without explicit user selection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a web search and summarization assistant, but its manifest also grants write capability without a clear, necessary reason tied to that purpose. This expands the skill’s authority beyond user expectations and creates a path for unintended file modification or persistence if the agent follows ambiguous instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation is internally contradictory: it says the free version does not support export or history saving, yet also states that create/query/export operations are supported via input_params. Such inconsistencies can cause an agent or user to authorize actions the skill was supposedly not meant to perform, including data creation or export behaviors.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill claims that result export is unsupported, but elsewhere advertises file read/parse/write as a core function. That mismatch obscures the true behavior of the skill and increases the risk that users or orchestrators permit file operations that exceed the expected search-only scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The search behavior table sets the language preference to Chinese as a default operational behavior, but there is no accompanying user opt-in or configurable language choice. For a general-purpose search skill, fixing locale/language behavior this way can violate organizational language-choice policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description and user-facing guidance do not clearly warn that it may execute system commands and perform file writes. This undermines informed consent and can lead users or calling agents to invoke the skill under the mistaken assumption that it only performs passive web search and summarization.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.