Code Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:27 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent read-only code search wrapper, but its design docs include unsafe fallback instructions for installing downloaded binaries system-wide.

Install only if you are comfortable with a local code-search tool reading files under paths you provide. Prefer OS package-manager installs for rg, fd, and tree; do not follow the fallback curl/tar/cp instructions into /usr/local/bin unless you independently verify checksums or signatures and understand the system-wide impact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: DESIGN.md:208

Finding

Unverified Binary Downloads Installed into a System-Wide Executable Directory

Content

View full analysis

Vulnerability Details

File Location: DESIGN.md:208-213
Vulnerability Type: Supply-chain exposure through unverified binary installation
Risk Level: Medium

Vulnerable Code

bash

# ripgrep
curl -LO https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz
tar xzf ripgrep-*.tar.gz && cp ripgrep-*/rg /usr/local/bin/

# fd
curl -LO https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-unknown-linux-musl.tar.gz
tar xzf fd-*.tar.gz && cp fd-*/fd /usr/local/bin/

Technical Analysis

The design document instructs users to download executable archives, extract them, and copy the resulting binaries into /usr/local/bin without verifying a cryptographic signature or pinned checksum.

The URLs use HTTPS, fixed release versions, and the apparent upstream GitHub repositories. This reduces—but does not eliminate—the risk. Compromise of a release asset, publisher account, repository, or local TLS trust chain could cause an altered executable to be installed.

The wildcard expressions ripgrep-*.tar.gz, ripgrep-*/rg, fd-*.tar.gz, and fd-*/fd introduce an additional local substitution risk. If these commands are run in a directory containing attacker-controlled matching archives or extracted directories, tar or cp may process an unintended artifact. The instructions also do not isolate extraction in a newly created private temporary directory.

The executable script itself does not automatically perform these downloads. At scripts/search.sh:28 and scripts/search.sh:37, it only prints fixed installation URLs. Therefore, the risk arises when a user or administrator follows the installation procedure in DESIGN.md.

Attack Path

1. A user follows the fallback dependency-installation instructions in DESIGN.md.
2. An attacker compromises an upstream release asset or causes an attacker-controlled local archive or extracted directory to match one of the wildca ...[truncated 1212 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer distribution packages from trusted, configured operating-system repositories.
2. If release archives must be used, pin the expected SHA-256 digest and verify it before extraction:

bash

archive="ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz"
curl --fail --location --proto '=https' --tlsv1.2 \
  --output "$archive" \
  "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/$archive"

echo '<PINNED_SHA256>  ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz' |
  sha256sum --check --strict -

3. Verify an upstream cryptographic signature where the publisher provides one.
4. Download and extract inside a newly created private directory, such as one produced by mktemp -d, and clean it with a shell trap.
5. Replace every wildcard with an exact archive, directory, and binary name.
6. Inspect the extracted file type and permissions before installation.
7. Require explicit user approval before installing software.
8. Prefer a user-owned executable directory when system-wide installation is unnecessary.
9. If /usr/local/bin installation is required, perform only the final verified copy with the minimum necessary elevation.
10. Document the trusted source, exact version, checksum, expected architecture, and update procedure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The title explicitly presents the skill design document in Chinese ("设计文档"), and the rest of the document is written in Chinese without any opt-in, alternative language, or justification that the skill is region-specific. This can violate a language/locale policy when skills are expected to avoid forcing a specific language absent user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The title and the rest of the requirements are written in Chinese, but the document does not state that the skill is region-specific or that users may choose their preferred language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file presents its primary title, usage description, and subcommand descriptions in Chinese at the top of the script. Because this is a user-facing skill entrypoint and there is no stated language choice or opt-in, it creates a locale/language constraint that may conflict with organizational policy requiring language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.