Security audit
Security checks for vulnerabilities and agentic risk
This is a search-helper skill whose external web searches are expected for its purpose, with no code execution, persistence, credential use, or local data access found.
Install only if you want search queries routed through the listed third-party engines. Avoid submitting sensitive personal, financial, or confidential business terms unless you are comfortable with those providers receiving the query.
The manifest description includes vague trigger wording like “帮我搜索”, “查一下”, “搜索”, “财经新闻”, and “最新消息”, which weakens invocation boundaries at the metadata level. Because these terms are common in ordinary user requests, the system may over-match and route unrelated conversations into this skill.
The trigger phrases are very generic everyday expressions such as “搜索”, “查一下”, and “找一下”, which can cause the skill to activate unintentionally during normal conversation. Unintended activation may send user queries to external search providers without clear consent, increasing privacy and prompt-routing risk.
The skill encourages use of many third-party search engines and provides direct web_fetch examples, but does not clearly warn that user queries will be transmitted to external services. This creates a privacy and data-handling risk, especially for sensitive personal, financial, or corporate research terms.
No suspicious patterns detected.
