Security audit

多搜索引擎免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a search-link generator, but its documented command examples can execute unsafe local code from crafted search text and can open third-party search pages without clear consent.

Review before installing. Use this only for non-sensitive searches, avoid secrets or private customer data in queries, and do not run the bash snippets with untrusted query text unless the python3 -c interpolation is fixed. Prefer generating links first and opening them manually.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:85
Finding: Arbitrary Python Code Execution Through Unsafe Search Query Interpolation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says the skill provides '结果聚合展示' and the overview repeatedly describes aggregating results from multiple engines. However, the included Bash and Python code only URL-encodes the query and returns/prints per-engine search links; it does not fetch, parse, or display actual search results. This is a semantic mismatch between the advertised capability and the implemented behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Several sections state that execution supports '创建/查询/导出操作', which suggests broader operational behavior. The actual code snippets only build and print search URLs or structured link data and do not implement creation or export workflows. This is an active contradiction in the documentation about what the skill does.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Earlier capability sections say the tool returns '搜索结果聚合' response data and structured results, implying retrieved or aggregated search outcomes. Later, the FAQ explicitly states '免费版生成搜索链接,需在浏览器中查看结果' and that direct result content requires the pro API. These statements materially conflict about whether the free version returns search results or just links.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs opening external search-engine links but does not provide a clear privacy or data-egress warning. User queries may contain sensitive terms, and sending them to multiple third-party search providers expands exposure and tracking risk, especially in enterprise or agent-assisted settings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Automatically invoking the system browser to open external links creates immediate side effects without a prominent risk prompt. In practice this can exfiltrate sensitive search terms, trigger browser-based tracking, and surprise users who expected local-only processing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: L363-L365 将触发条件描述为“需要SEO优化、关键词分析、排名提升、搜索流量优化时使用”，范围明显大于该技能实际提供的多搜索链接生成与聚合能力。这些表述覆盖大量常见工作场景，但没有限定具体触发短语、上下文约束或负面示例，容易造成非预期调用。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest positions the free edition as supporting 8 major search engines, but the usage example under technical retrieval also includes '代码搜索' and 'Stack Overflow' links beyond the declared eight. That expands the apparent scope of the skill beyond the manifest's stated free-version boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: L268-L301 将一个典型使用场景定义为“中英文双语搜索”，并固定中文引擎使用中文关键词、国际引擎使用英文关键词。该描述对语言使用作了预设，但没有说明这是可选模式或允许用户按自身语言偏好配置，存在轻微的语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill includes behavior to automatically open externally constructed URLs in the system browser, which goes beyond passive link generation and can trigger unintended outbound requests. In an agent context, this can leak user queries to third-party search engines and create unsafe side effects without an explicit confirmation step.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:85