网络搜索助手

• Outcome: Review
• Latest audit: May 28, 2026 · 6:32 AM UTC
• Version: 1.0.0

Overview

This is a real web-search skill, but it ships with an embedded Serper API key and does not clearly warn users about third-party query handling.

Review before installing. Treat every search as data sent to Serper/Google-backed infrastructure, avoid sensitive queries, and remove the embedded API key before use. The publisher should rotate the exposed key and require users to configure their own secret through a safer mechanism such as an environment variable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill performs network-based search but does not declare that capability in its permissions/metadata, which reduces transparency and can bypass user or platform expectations about outbound data flow. In this context, user search queries are sent to a third-party API, so undeclared network access creates privacy and governance risk even if the core function legitimately requires networking.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior understates what the implementation does: static analysis indicates a hardcoded Serper API key and additional extraction of answer-box and weather data beyond the stated scope. A hardcoded credential is especially dangerous because it can expose a reusable secret to anyone with access to the skill, enabling unauthorized API use, quota theft, and possible attribution of abuse to the key owner.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The file contains a hardcoded Serper API key directly in source code, which exposes a live credential to anyone with repository or package access. This enables unauthorized use of the external service, quota theft, billing abuse, and makes credential rotation difficult once the skill is distributed.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: Using a very broad trigger pattern built around the generic verb “搜索” can cause the skill to activate in situations the user did not intend, sending arbitrary user text to an external search provider. In a networked skill, overbroad invocation increases accidental data disclosure and makes it easier for unrelated prompts containing that verb to trigger outbound requests.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill does not clearly warn that user queries will be transmitted to a third-party service, which creates a privacy and consent issue. Because search queries may contain sensitive personal, business, or confidential data, lack of disclosure makes accidental data exfiltration more likely in normal use.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A hardcoded credential is not only stored insecurely but is also actively used in outbound requests, meaning the skill performs authenticated third-party actions under a shared embedded identity. Users may unknowingly consume someone else's API quota or expose the maintainer to abuse, and attackers can trivially extract and reuse the credential.

Static analysis

No suspicious patterns detected.