Smart Web Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 2.0.0

Overview

This is a real web-search skill, but it has under-scoped network fetching and browser automation risks that users should review before installing.

Review this before installing in any environment with internal web services, cloud metadata access, or sensitive developer credentials. Prefer running it in a contained, low-privilege environment with restricted outbound network access, avoid sensitive search terms or internal URLs, and require locked dependencies before setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch.js:188

Finding

Arbitrary HTTP Targets and Redirects Enable Server-Side Request Forgery

Content

View full analysis

a.startsWith('http')); ``` `scripts/playwright-support.js:13-19`: ```js export const BROWSER_ARGS = [ '--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage', '--disable-accelerated-2d-canvas', '--disable-gpu', ]; ``` `scripts/playwright-support.js:123-126`: ```js return chromium.launch({ headless, executablePath: execPath || undefined, args: BROWSER_ARGS, }); ``` ### Technical Analysis The fetch command accepts a URL whenever its string begins with `http`. It does not validate the parsed scheme, destination hostname, resolved IP addresses, port, or redirect destinations. In particular, it does not reject: - IPv4 or IPv6 loopback addresses - RFC 1918 private networks - Link-local addresses - Cloud instance metadata endpoints - Reserved or special-purpose networks - Public hostnames that resolve to internal addresses - Public URLs th ...[truncated 2673 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:64

Finding

Dependency Installation Is Not Reproducible or Locked to Audited Artifacts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description emphasizes a smart web search system with region detection, query rewriting, and compatibility across China/international networks. However, the supplied code chunk does not perform search at all: it takes explicit URLs as input, fetches them, and extracts readable content using two tiers (HTTP and browser rendering). The only part that aligns is the 'dual-tier content fetching' idea. There is no evidence of search engine querying, no region/network detection logic, and no intent rewriting of user queries. Therefore the description materially overstates and mischaracterizes the code’s primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code does not implement search functionality. Instead, it provides low-level browser management helpers: reading a local .browser-endpoint file, checking whether a PID is alive, searching the filesystem and environment variables for a Chromium executable, and launching Chromium via Playwright, including a browser server. These are materially different capabilities from the declared purpose. While browser launch support could be a supporting detail in a larger web-search skill, this chunk contains none of the promised features such as region detection, query rewriting, or dual-tier fetching, and it introduces operational capabilities (filesystem inspection, process checks, local browser/server launch) not reflected in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description partially matches the code: it does implement auto region detection and a form of dual-tier fetching (search results plus optional content fetch), and it is designed to work across China/international networks. However, a key declared capability—'query intent rewriting'—is not present. In fact, the file header explicitly states '不做 query 改写，不做城市/意图识别' (does not do query rewriting, city/intent recognition). That is a direct contradiction of the declared description, making this a material mismatch. The specific use of Bing CN and DuckDuckGo via Playwright is an implementation detail rather than a mismatch by itself, but the main declared functionality is overstated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a runtime web search capability with query rewriting and content fetching. The supplied code does not implement search behavior at all. Instead, it is an installation/setup script that prepares the environment by checking Node, selecting mirrors based on region, installing packages, locating or downloading Chromium, and running a verification script. While region detection loosely aligns with the description's China/international compatibility claim, the primary purpose and actual capabilities are materially different. This is therefore a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Very broad trigger keywords like search, find, look up, and common Chinese equivalents are likely to match ordinary user requests across many contexts, causing accidental invocation of this skill. Because the skill can initiate outbound network requests and content fetching, overbroad activation increases the chance of unintended data disclosure, unexpected browsing, or policy bypass through opportunistic triggering.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

script: scripts/search.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

script: scripts/search.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

script: scripts/search.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

script: scripts/search.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

script: scripts/search.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

script: scripts/search.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

node scripts/fetch.js "https://example.com/page1" "https://example.com/page2"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run npx playwright without pinning a specific version, which can fetch and execute whatever package version is current at install time. This creates a supply-chain risk: a compromised upstream release or unexpected breaking update could run arbitrary installer code on the user's machine during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises region detection, web search, and content fetching against multiple external services but does not clearly warn users that queries, IP-derived metadata, and fetched URLs/content will be transmitted to third parties. In a security-sensitive agent skill, this omission can lead to unintentional data disclosure, especially if users pass sensitive prompts or internal research terms into the tool.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares a tool that performs network access, invokes local scripts, and relies on shell-based setup/verification, but the manifest does not declare any explicit permission or allowed-tools boundary. This weakens host-side policy enforcement and makes it harder for reviewers and runtimes to constrain what the skill is allowed to do, increasing the chance of unintended network, environment, or command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 78% confidence

Finding

Using npx playwright without pinning a specific version allows the resolved package version to change over time, which can introduce supply-chain risk or unexpected behavior. In a skill that also downloads browser components and executes local automation, an unpinned toolchain increases the blast radius of a compromised or incompatible upstream release.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states the skill is "智能联网搜索" in Chinese and presents the functionality only in that locale, with no indication that users can choose another language or that the locale restriction is intentional and justified. This matches the policy category for language or locale constraints imposed without explicit opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script hard-codes an Accept-Language preference of zh-CN/zh ahead of English, which imposes a specific locale on all lightweight fetches. The file does not offer a user choice or document a justified region-specific constraint, so this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Playwright path explicitly sets Accept-Language to prefer zh-CN/zh for all browsing sessions. Because no user choice or documented justification is provided, the skill enforces a locale preference in a way that violates the stated language/locale policy criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a web search skill with region detection, query rewriting, and content fetching, which implies making HTTP requests and retrieving pages, but this file adds full Playwright browser launch and browser-server capabilities. Spawning and managing a Chromium instance is a substantially broader automation capability than ordinary search/fetch logic and is not explicitly justified by the stated purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-of-file documentation says routing is based only on IP attribution and explicitly states there is no query rewriting, no city/intent recognition, and no low-quality domain filtering. This directly conflicts with the skill description claiming 'auto region detection' plus 'query intent rewriting,' creating an intent/documentation divergence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes 'query intent rewriting' and 'dual-tier content fetching' as core capabilities. However, the header comment explicitly states '不做 query 改写' (no query rewriting), and the implementation only has one optional content-fetch stage via autoFetch rather than a dual-tier retrieval design.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill automatically contacts third-party IP geolocation services and Bing to infer whether the user is in China, disclosing the host's public IP, user agent, and network metadata without explicit notice or consent. In an agent setting, this can leak operator environment details and create unexpected outbound traffic to external services before the user has approved any search action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.