Security audit

搜索引擎

Security checks across malware telemetry and agentic risk

Overview

This search skill is mostly documentation-only, but it asks for broad file and command authority that is not well scoped for a web-search tool.

Review this before installing. It may be fine for a controlled agent, but grant it only the minimum tools needed for search, avoid giving it shell execution or write access unless you explicitly need those behaviors, and use scoped API keys with sensitive queries redacted where possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documented output schema is unrelated to search results and instead describes a grading/report structure, which can mislead an agent into treating arbitrary evaluation data as the skill's expected output. In a skill that may be composed into automated workflows, this kind of semantic mismatch increases the risk of downstream mis-execution, unsafe chaining, or hidden behavior being smuggled behind misleading documentation.

Intent-Code Divergence

Low

Confidence: 81% confidence
Finding: The skill claims privacy protections such as not storing personal search records, yet its declared capabilities include read access and command execution without any concrete enforcement details, retention policy, or scope restrictions. This discrepancy can create unjustified trust and cause users or agents to expose sensitive queries or credentials under false assumptions about data handling.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill is presented as a search integration, but its documented scope expands to file handling, file writing, API access, and system command execution. This is dangerous because it widens the operational authority of the skill beyond user expectations, making it easier to disguise high-impact actions under a benign search-oriented label.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: File processing and command execution are not justified by the stated purpose of a multi-search-engine skill and materially increase the attack surface. In an agent environment, unnecessary exec or file-oriented behavior can be abused to read local data, alter files, or run system commands when a user only intended to perform web searches.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Advertising file handling and writing capability without an explicit warning about modifying user data creates a consent and safety gap. Users invoking a search skill may not anticipate local data changes, which raises the risk of accidental overwrites, unauthorized persistence, or hidden side effects in automated workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Advertising command execution without a prominent warning about system-impacting actions is dangerous because users may invoke the skill under the assumption it only performs searches. In agent ecosystems, silent or poorly disclosed execution capability can lead to unintended system changes, data exposure, or abuse through prompt-induced command invocation.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The quick-start section instructs users to configure API keys and make external API calls without clearly warning that search queries, metadata, or other inputs may be transmitted to third parties. This can expose sensitive research terms, credentials, or operational context, especially in a security-focused usage scenario.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.