zhipu web search

• Outcome: Pass
• Latest audit: May 28, 2026, 5:02 AM
• Version:
  1.0.8

Overview

This is a straightforward Zhipu web-search wrapper that sends user-provided search queries to Zhipu using the configured API key, with no hidden persistence or destructive behavior found.

Install this only if you are comfortable sending search queries to Zhipu/BigModel under your Zhipu account. Use a revocable API key if possible, avoid putting secrets or confidential material in queries, and rotate the key if you stop using the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to send arbitrary search queries and an API credential to a third-party service without any warning that prompts may contain sensitive data or that data leaves the local environment. In an agent setting, this can cause unintentional disclosure of proprietary, personal, or regulated information to an external provider.

VirusTotal

66/66 vendors flagged this skill as clean.