搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:00 AM UTC
• Version: 1.0.0

Overview

This skill is framed as an internet-search helper but requests broad local file and command-execution capabilities that are not clearly needed for that purpose.

Review this skill before installing. It does not show evidence of malware, persistence, or data theft, but it asks for command execution and broad local file access while presenting itself mainly as an internet-search helper. Install only if your host environment can restrict or deny those tools, or after the publisher narrows the permissions and documents exactly when local files or commands may be used.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:19

Finding

Excessive Filesystem and Command-Execution Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–23
Vulnerability Type: Violation of least privilege through unnecessary filesystem and command-execution capabilities
Risk Level: Medium

Complete Code Snippet:

yaml

tools:
  - read
  - exec
  - glob
  - grep

Technical Analysis

The skill describes internet-search query construction, category routing, and multi-step searching. That documented purpose does not justify access to general-purpose local file-reading, filesystem-discovery, content-search, or command-execution tools.

Declaring read, glob, and grep may allow the agent to discover and inspect files accessible to its host process. Declaring exec may allow local commands to run with the host agent's operating-system privileges. The declaration does not impose enforceable path restrictions, a command allowlist, validated arguments, or a least-privilege sandbox.

This is a capability exposure rather than evidence of active malicious execution: the reviewed project contains no instruction that explicitly abuses these tools. Exploitation depends on the hosting platform granting the declared capabilities and on an untrusted or manipulated instruction causing their misuse.

Attack Path

1. A host loads the skill and grants the tools declared in its metadata.
2. The skill receives attacker-controlled instructions or context, or otherwise processes adversarial content.
3. The agent is induced to use glob, grep, or read to locate and inspect files unrelated to internet searching.
4. The agent may disclose accessible local information through its response or downstream tool calls.
5. If exec is available without effective host-side restrictions, the agent may be induced to execute commands outside the skill's legitimate search function.

Impact Assessment

The potential scope is bounded by the privileges of the host agent process and any sandbox enforced by ...[truncated 614 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove read, exec, glob, and grep from the tool declaration because they are not required for the documented internet-search function.
2. Declare only the specific internet-search capability needed by the skill.
3. If local execution is genuinely necessary, replace general-purpose exec access with a narrowly scoped wrapper exposing fixed operations.
4. Enforce a strict command allowlist and reject shell metacharacters, command substitution, redirection, and unvalidated user-controlled arguments.
5. Restrict filesystem access to explicitly approved directories and deny access to credentials, configuration secrets, user home directories, and system paths.
6. Run permitted operations in a sandbox with minimal operating-system privileges, read-only storage where possible, network restrictions, resource limits, and no inherited secrets.
7. Require explicit user confirmation before any local file access or command execution and maintain auditable tool-call logs.
8. Add tests verifying that search inputs cannot cause local file discovery, file reads, or arbitrary command execution.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill declares exec and documents command execution despite its stated purpose being internet-search assistance. Unnecessary command-execution capability violates least privilege and creates a direct path for prompt-driven shell actions, which could lead to arbitrary command execution, data exposure, or environmental tampering if an agent enables the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file mixes Chinese and English in key user-facing fields such as displayName, summary, and description, but does not state a language-selection policy or offer the user a choice. This can impose a locale or language experience on users without opt-in, which matches the policy concern for language handling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description states the skill is not suitable for complex requirements beyond its capability scope. This conflicts with later claims in L033-L037 that the skill supports advanced paid features such as multi-source aggregation, semantic summarization, scheduled monitoring, structured research export, and knowledge graph reasoning, which are complex capabilities inconsistent with the earlier limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use the skill whenever the user needs 'internet-search related functionality', which does not define clear trigger boundaries or concrete invocation phrases. This broad wording can overlap with many general research or information requests and may cause unintended activation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as an internet-search usage guide, but later advertises broad file processing, API integration, and command execution capabilities that materially exceed that scope. This scope creep can cause agents or users to grant more trust and permissions than intended, increasing the chance that dangerous tools are invoked under the guise of a harmless search skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.