Security audit
Security checks for vulnerabilities and agentic risk
This search-assistant skill is purpose-aligned and contains no executable code, but users should be aware that context-aware web searches and optional search-pattern tracking can expose query context.
Before installing, use this skill only with searches you are comfortable sending through web search. Avoid asking it to include sensitive prior-chat details in optimized queries, and review or disable any future self-improving-agent integration that records search patterns.
The skill explicitly performs web searches and uses conversation context to optimize queries, but the documentation does not warn users that their queries and possibly prior chat context may be sent to external search services. This creates a privacy and data-handling risk because users may unknowingly disclose sensitive information to third parties during normal use.
The integration note says the skill can work with a self-improving agent to record search patterns and optimization effectiveness, which is telemetry-like behavior. Without an explicit warning, consent mechanism, and retention controls, this can enable silent collection of behavioral data about user interests and activity.
The file presents all user-facing instructions and examples in Chinese, which effectively forces a specific language for use and maintenance without opt-in or explanation. The policy allows locale constraints only when they are user-selectable or clearly justified as region-specific, neither of which is stated here.
No suspicious patterns detected.
