Free Web Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:13 AM UTC
• Version: 8.1.0

Overview

This search skill is mostly transparent, but its optional full-page fetch loads arbitrary search results in an unsandboxed browser, which is risky enough to require review before installing.

Install only if you are comfortable with a search tool sending queries and IP metadata to search/geolocation services. Keep --full at 0 unless needed, run it in an isolated low-privilege environment, avoid running setup as root, prefer a virtual environment with pinned dependencies, and do not use untrusted package mirrors.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/web_search.py:33

Finding

Untrusted Search Result Pages Are Loaded in an Unsandboxed Browser

Content

View full analysis

{ document.querySelectorAll('script,style,nav,header,footer,.ad,.ads,[class*="banner"],[id*="banner"],.sidebar,.comment,.popup,.modal,.cookie').forEach(e=>e.remove()); for (const sel of ['article','main','.content','.post','.article','#content','#main','.entry-content','.post-content','[itemprop="articleBody"]']) { const m = document.querySelector(sel); if (m && m.innerText.length > 200) return m.innerText; } return document.body ? document.body.innerText : ''; }""") except Exception as e: print(f"[fetch] 失败: {e}", file=sys.stderr) finally: try: ctx.close() except Exception: pass result = (text or "").strip()[:8000] print(f"[fetch] {len(result)}字 | {time.time() - start:.1f}s", file=sys.stderr) return result or "抓取失败" ``` ```python if full > 0 and results: for i in range(min(f ...[truncated 3101 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:17

Finding

Unpinned Dependencies Are Installed from Mutable Package Sources

Content

View full analysis

/dev/null; then PIP=pip elif command -v pip3 &>/dev/null; then PIP=pip3 else echo "[ERROR] 找不到 pip，请先安装 Python 3.10+" exit 1 fi echo "[1/3] 安装 Python 包..." $PIP install playwright $PIP_ARGS echo "[2/3] 安装 Chromium 浏览器..." playwright install chromium ``` The manual installation instructions in `SKILL.md:72-85` expose the same unpinned installation behavior: ```bash pip install playwright playwright install chromium ``` ### Technical Analysis The setup process installs `playwright` without an exact version or cryptographic hash and then downloads the browser revision selected by the installed Playwright release. Consequently, identical setup commands can install different code at different times. The installer invokes whichever `pip` or `pip3` executable is first on `PATH` and does not create an isolated virtual environment. This can modify the active or system Python environment and can create conflicts with unrelated applications. When a mirror is supplied, the script automatically adds `--trusted-host`. This permits pip to treat the specified host as trusted and can weaken normal transport-security expectations, particularly if the supplied mirror uses insecure HTTP or is controlled by an untrusted party. Python package installation and browser installation both process remotely supplied artifacts. Although the audited project does not deliberately retrieve and execute an application payload at runtime, an unsafe or compromised package source could provide altered dependency code during setup. ### Attack Path 1 ...[truncated 1275 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

script: scripts/web_search.py

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

script: scripts/web_search.py

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

script: scripts/web_search.py

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

script: scripts/web_search.py

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

script: scripts/web_search.py

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill performs outbound network access to search engines, IP geolocation services, and optionally arbitrary target pages, but the manifest does not declare an explicit permission/scope boundary such as allowed tools or network permissions. This weakens least-privilege controls and makes it easier for a host system or reviewer to miss that user queries and environment metadata will be sent to third parties.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The browser context is created with fixed locale and language headers and a fixed Asia/Shanghai timezone, which imposes a specific locale profile on requests. This matches a natural-language policy concern because the skill does not offer users a language/locale choice for this behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Bing search path forces a zh-CN locale, and the DuckDuckGo path forces en-US, tying output language and request characteristics to internal routing rather than user preference. The file does not provide a user-visible choice or opt-in for this language/locale selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The DDG path explicitly sets locale to en-US and Accept-Language to English, which can affect returned content language and regional behavior. This is a locale policy issue because the user is not given control over that setting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description states the tool is '中文环境优化', which sets an expectation that the skill is optimized for a specific language/locale by default. Under the policy, locale-specific behavior should either be user-selectable or clearly justified as region-specific; here it is presented as the default behavior for the general skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The line says the tool defaults to 'mkt=zh-CN' and returns primarily Chinese results. This is a language/locale constraint applied by default, and the documentation does not frame it as an opt-in choice or as a narrowly justified region-specific compliance requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s natural-language comments and console output are written in Chinese throughout, including usage and error/help text. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.