Security audit

聚合搜索工具

Security checks for vulnerabilities and agentic risk

Overview

This looks like a search skill, but it asks for or documents broader local command and file-changing powers than the search purpose explains.

Review before installing. Use this only with non-sensitive searches or a trusted self-hosted SearXNG instance, and avoid granting write access unless the package is narrowed to search-only behavior. The artifact should clarify unsupported export/cache features and remove unrelated file-processing authority before routine use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documentation contradicts itself about whether export operations are supported in the free version, which can cause an agent or user to attempt higher-risk actions that were supposedly disallowed. In a skill with exec/write capability, ambiguity around allowed operations weakens safety boundaries and can lead to unintended data handling or file generation.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill says caching is unsupported, but later instructs users to enable cache, creating uncertainty about whether search data may be retained. For a search tool that may use public SearXNG instances, undocumented caching can expose user queries or sensitive research terms beyond user expectations.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill is presented as a search aggregator, but later claims file read/write as a core function, which materially expands the operational scope. This mismatch can cause over-privileged usage and make users or agents invoke local file operations unrelated to search, increasing the chance of unauthorized modification or data exposure.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The manifest grants write access even though the skill's stated purpose is internet search, violating least-privilege principles. If invoked by an agent, this unnecessary capability could be abused to alter local files, persist unwanted data, or stage follow-on actions unrelated to searching.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger condition is broad and ambiguous, so the skill may activate for loosely related SEO or optimization requests without clear user intent. In combination with exec and external-search behavior, over-broad triggering increases the risk of unneeded network disclosure and unnecessary command execution.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill does not clearly warn users that their queries may be sent to external or public SearXNG instances, which is a meaningful privacy and data-handling risk. Users may submit proprietary, personal, or sensitive terms under the false assumption that searches stay local.

Static analysis

No suspicious patterns detected.