Smart Web Search

• Outcome: Review
• Latest audit: Jun 22, 2026 · 12:52 PM UTC
• Version: 3.2.2

Overview

This is a real web-search skill, but it can automatically send broad user requests to external services and visit arbitrary pages with a weakened browser sandbox.

Install only if you are comfortable with search terms, your public IP, and visited result URLs being exposed to search engines, IP lookup services, and destination websites. Use --fetch=0 or --no-fetch for sensitive searches, prefer explicit region selection when possible, and run the skill in a contained environment because its browser fallback disables Chromium sandboxing.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is presented as a web search tool, but it also retrieves full page content from search results by default. This expands data access and outbound network activity beyond user expectations, which can expose sensitive queries to third-party sites and pull untrusted content into downstream agent context.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The README promotes automatic web search, region detection, and content fetching but does not explicitly warn users that queries, URLs, and network metadata will be sent to third-party services. In an agent skill context, this can lead to unintended external transmission of user-provided or sensitive data, especially because the tool performs multiple outbound requests and fallback fetches automatically.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger keywords are extremely generic (for example, 'search', 'find', 'look up', and common Chinese equivalents), making accidental invocation likely during ordinary conversation. In this skill, accidental activation is more dangerous because invocation can launch browser automation, perform outbound searches, detect region via external services, and fetch page content, which may leak user intent or cause unexpected network activity without clear user consent.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: The code unconditionally sends an `Accept-Language` header preferring Chinese locales, which can reveal user or environment assumptions and alter server responses without user consent. This is primarily a privacy and transparency issue rather than a direct exploit path, but it can misrepresent user preferences and increase fingerprinting consistency across requests.

Natural-Language Policy Violations

Medium

• Confidence: 74% confidence
• Finding: The Playwright path also forces Chinese-biased `Accept-Language` headers for all browser requests, again overriding user choice and creating unnecessary metadata leakage. In browser mode this can affect more requests during page load, including subresources, making the privacy concern slightly broader than the lightweight HTTP path.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Chromium is launched with '--no-sandbox' and '--disable-setuid-sandbox', removing a major browser security boundary. If the browser processes untrusted web content, a renderer compromise would have a much easier path to impact the host environment, which is especially relevant in a web-search skill that visits arbitrary sites.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Search terms are sent to external engines, and the skill then visits returned URLs automatically. In an agent setting, queries may contain sensitive internal prompts, identifiers, or user data, so silent transmission to third parties creates a real privacy and data-leakage risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The geolocation logic contacts multiple third-party IP intelligence services, disclosing the host's public IP and related metadata without explicit notice. In sensitive environments, this can reveal deployment geography, infrastructure usage, or operational patterns to external providers.

Static analysis

No suspicious patterns detected.