Security audit

OpenAssetSearch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward external asset-search helper, with privacy and untrusted-download cautions but no hidden execution, persistence, or credential access.

Install only if you are comfortable sending asset-search terms to WebSim and receiving direct links to community-uploaded public files. Avoid searching with secrets, private project names, customer data, or other sensitive terms, and review downloaded assets before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill instructs activation for very broad user intents such as finding or downloading assets, which can cause the agent to invoke an external service in response to ordinary requests without a clear user expectation that third-party search will be used. Because the skill sends user queries to a remote endpoint and returns direct-download URLs from untrusted user-uploaded content, overbroad invocation increases the chance of unnecessary data disclosure and unsafe external content retrieval.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill does not warn that user search terms are sent to the external service at https://websim.com/api/v1/search/assets. If users include confidential project names, personal data, or sensitive internal concepts in their requests, the agent may disclose that information to a third party without informed consent.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The example trigger phrases include generic everyday language like 'find me a...' or 'I need a sound for...', which are ambiguous and likely to match many normal conversations. This makes accidental invocation more likely, causing user prompts or project details to be transmitted to an external search service and potentially surfacing unreviewed direct-download links from public content.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill's invocation guidance is very broad and maps to common user intents like finding or getting images, audio, videos, or models. That creates an over-triggering risk where ordinary conversation may automatically route user queries to this external service, causing unintended third-party disclosure of user prompts and retrieval of unvetted public content.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill does not adequately warn users that their search terms are transmitted to a third-party endpoint. Because the skill is designed for natural-language asset searches, users may include confidential project names, internal codenames, or personal data in queries without realizing those terms are being disclosed outside the primary system.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The example trigger phrases are highly generic (for example, 'find me a...' or 'get me an image of...') and are likely to collide with routine conversation. In an agent environment, this can cause the skill to activate without clear user intent, sending request content externally and bypassing safer default handling for benign media-related queries.

Static analysis

No suspicious patterns detected.