聚合搜索工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.2

Overview

This appears to be a search skill, but it asks for broader command and file permissions than its search purpose needs and under-discloses external query handling.

Review before installing. Use a sandboxed agent, remove or deny write access, restrict exec to specific setup and health-check commands, prefer a trusted self-hosted SearXNG endpoint, avoid searching secrets or internal identifiers, and pin Docker and Python dependencies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6

Finding

Excessive and Inconsistent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-22
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

Technical Analysis

The Skill contains two inconsistent tool-permission declarations. The allowed-tools field grants read and exec, while the later tools field additionally requests write.

Filesystem write access is not necessary for the documented search operation. The Skill also describes generic file processing and system-command execution at lines 383-385, extending its requested capabilities beyond querying a SearXNG endpoint.

If a host platform treats the broader tools field as authoritative, the Skill may receive filesystem modification privileges that are not required for its stated purpose. Broad exec access also lacks an enforceable command allowlist; the security guidance at line 352 recommends a whitelist but does not define or implement one.

No evidence shows that the Skill currently uses these permissions maliciously. The vulnerability is the unnecessary and ambiguous privilege request, which breaks the principle of least privilege and increases the impact of prompt injection or untrusted search content.

Attack Path

1. An Agent loads the Skill and parses its tool declarations.
2. The hosting platform resolves the conflicting declarations by granting the broader exec, read, and write set.
3. The Agent processes attacker-controlled search content or a malicious instruction embedded in external content.
4. That content induces the Agent to invoke the broadly available command or write tools.
5. Commands execute or files are modified within the operating-system permissions of the Agent process.

Impact Assessment

A successful exploitation could permit modification of files accessible to the A ...[truncated 291 chars]

Remediation

View remediation

Remediation Suggestions

• Remove write because the documented search workflow does not require filesystem modification.
• Replace the conflicting declarations with one authoritative tool-permission list.
• Avoid granting unrestricted shell execution. Expose a dedicated search API tool instead of a general-purpose exec capability.
• If command execution is unavoidable, enforce a host-level allowlist containing only fixed commands and arguments.
• Run all commands in a restricted sandbox with minimal filesystem access, no elevated privileges, and constrained network access.
• Treat all search results and remote content as untrusted data and prevent them from supplying executable Agent instructions.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:317

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 317
Vulnerability Type: Mutable and unverifiable dependency installation
Risk Level: Low

Vulnerable Code

bash

pip install requests

Technical Analysis

The setup instructions install requests without a fixed version or integrity hash. As a result, the effective dependency can change over time without any modification to the reviewed Skill.

Although requests is a legitimate package and the audit found no evidence of typosquatting or an intentionally malicious dependency, an unpinned installation is not reproducible. It may retrieve an incompatible, compromised, or otherwise unreviewed future release. The command also does not explicitly constrain package resolution to an approved repository.

Attack Path

1. An operator follows the documented setup procedure.
2. pip resolves the mutable latest version of requests and any transitive dependencies from its configured package index.
3. A compromised index, maliciously altered environment, or compromised future package release supplies unreviewed code.
4. The package is installed into the Agent environment.
5. The unreviewed code executes when imported or through installation-related behavior, with the privileges of the Python or Agent process.

Impact Assessment

Exploitation could execute third-party code with the privileges of the environment performing the installation or import. Depending on the deployment, this could expose environment variables, local files, search queries, network credentials, or the integrity of the Agent workspace. The likelihood is limited because the named package is legitimate and no active package compromise was identified.

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to reviewed versions in a lock file.
• Require hashes, such as through pip install --require-hashes -r requirements.txt.
• Configure installation to use an explicitly approved package index.
• Scan dependencies for known vulnerabilities and define a controlled update process.
• Install dependencies in an isolated, non-privileged virtual environment or container.
• Store the dependency manifest in the project so that the reviewed package versions are reproducible.

other

Note

• Location: SKILL.md:144

Finding

Potential Disclosure of Search Queries to a Public SearXNG Instance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 144
Vulnerability Type: External transmission of potentially sensitive search data
Risk Level: Low

Vulnerable Code

bash

export SEARXNG_URL=https://searx.be

Technical Analysis

The Skill recommends a specific public SearXNG instance as a configuration option. Queries sent through that endpoint leave the local trust boundary and may be visible to the public instance operator and relevant upstream search providers.

The documentation does not provide a privacy warning, require user consent, or prohibit secrets, personal data, internal hostnames, proprietary source fragments, and other confidential information in queries. HTTPS protects the connection in transit but does not prevent the destination service from receiving or retaining query data.

No evidence establishes that the named instance is malicious or that it improperly retains queries. The issue is the undocumented disclosure risk created when users adopt a third-party service for potentially sensitive searches.

Attack Path

1. An operator configures the recommended public endpoint.
2. A user or Agent submits a search containing sensitive technical, personal, or business information.
3. The query is transmitted to the public SearXNG operator.
4. The instance may forward all or part of the query to upstream search engines.
5. Query content and associated metadata may consequently be processed or logged outside the user's organization.

Impact Assessment

The affected scope is limited to submitted queries and related connection metadata. Potential impact includes disclosure of internal project names, security research topics, personal information, proprietary error messages, or other confidential terms to third parties. This finding does not provide local code execution or additional system privileges.

Remediation

View remediation

Remediation Suggestions

• Default to a controlled, self-hosted SearXNG deployment rather than a public instance.
• Clearly disclose that public-instance queries are transmitted to third parties.
• Require informed user approval before enabling an external endpoint.
• Warn users never to include credentials, tokens, personal data, proprietary source code, internal URLs, or confidential identifiers in queries.
• Provide endpoint allowlisting and administrative policy controls.
• Review the selected instance's privacy policy, retention practices, TLS configuration, and operational ownership.
• Where feasible, redact sensitive values before transmitting queries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description explicitly states '支持中文交互' and the document is written as if Chinese is the expected interaction mode, without offering a language choice or stating that other languages are equally supported. This can violate language or locale policy when a skill implicitly enforces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is presented as a search-only tool, but its manifest includes write capability and the text references create/export-style operations. This mismatch can mislead users and agents into granting broader permissions than necessary, increasing the blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill lacks a clear warning that user queries are transmitted to external SearXNG instances and downstream search engines. This can lead to accidental disclosure of sensitive prompts, internal project names, credentials, or proprietary research terms, especially when using public instances.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation contradicts itself by saying export is unsupported in the free version while also stating that operations support create/query/export. Such inconsistencies can cause an agent or user to attempt unsupported workflows, potentially invoking broader tooling or fallback behavior not intended for a simple search skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition is broadly scoped to SEO optimization, keyword analysis, ranking improvement, and traffic optimization, which can cause the skill to activate in loosely related contexts. Overbroad routing matters here because the skill also exposes network access and execution-oriented instructions, increasing the chance of unintended use with sensitive queries or excessive permissions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 81% confidence

Finding

The skill instructs users to run docker run -d -p 8080:8080 searxng/searxng without pinning an immutable tag or digest. This creates a supply-chain risk because the pulled image may change over time or be replaced with a malicious or broken version, and the skill also grants exec, making the instruction more actionable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's stated purpose is internet search, but later it claims broad capabilities like file processing, API integration, and command execution. This expands the implied trust boundary far beyond search and may induce users or orchestration systems to allow dangerous operations under the guise of a benign search tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill claims generic file processing and writing capabilities unrelated to a search aggregation tool. Unnecessary write-oriented functionality increases the risk of unauthorized file modification, data tampering, or persistence if the skill is triggered in a permissive agent environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims generic command execution despite being framed as a search tool. In context, this is especially dangerous because exec can be used to run arbitrary system commands, turning a low-risk information retrieval skill into a potentially host-impacting execution surface.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The limitations section says custom engine configuration is unsupported, but a later example uses internet_search("query", engines="google,bing"), which implies caller-controlled engine selection. This is a direct contradiction in documented behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

One section clearly states that search result caching is not supported in the free version. Later, the troubleshooting guidance suggests calling internet_search(..., cache=true), which directly conflicts with that declared limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.