Multi Ai Search Analysis

• Outcome: Review
• Latest audit: May 28, 2026 · 7:04 AM UTC
• Version: 1.0.2

Overview

The skill appears to do its stated job, but it deserves review because it can send your prompts to several logged-in AI services and persist reports/browser session data with limited privacy warnings.

Install only if you are comfortable sending the same prompt to multiple third-party AI providers under your logged-in accounts. Do not use it with secrets, personal data, regulated data, internal documents, or confidential business material unless you have approval. Protect or regularly clear the browser-profile directory because it can contain reusable login sessions, and review saved reports before backing them up or sharing them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""运行命令并显示进度"""
    print(f"{Fore.CYAN}[{description}]{Style.RESET_ALL}")
    try:
        result = subprocess.run(cmd, shell=True, check=True, capture_output=True, text=True)
        print(f"{Fore.GREEN}✓ 完成{Style.RESET_ALL}")
        return True
    except subprocess.CalledProcessError as e:

• Confidence: 88% confidence
• Finding: The helper executes shell commands with shell=True, which is dangerous because any current or future caller that passes untrusted input into cmd can trigger shell metacharacter expansion and command injection. In this file the present call sites are developer-controlled, so the immediate exploitability is limited, but the API design is unsafe and easy to misuse.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The script explicitly tells the user it will not actually send anything, but it presses Enter on a live chat input and acknowledges that the test message is left posted. This mismatch can cause unintended data transmission to an external service and erodes operator trust, especially if future test text includes sensitive content.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document promotes persistent login state ('一次登录，重复使用') without warning that browser session data, cookies, or local profiles may contain sensitive authentication artifacts. In a skill that automates access to multiple AI platforms, stored session state can increase the risk of account takeover or unintended reuse on shared or insufficiently protected systems.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document recommends copying reports to cloud storage without warning that reports may include sensitive prompts, outputs, account-related details, or user-specific research data. Because this skill aggregates multi-platform AI responses into saved reports, encouraging cloud backup without classification, redaction, or access-control guidance can lead to unintentional data exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example explicitly instructs users to query multiple third-party AI platforms, several of which require login, but it provides no warning that prompts and returned data will be transmitted to external services and potentially linked to user accounts. In a workflow meant for geopolitical, market, and policy analysis, users may paste sensitive research, proprietary business context, or personal data into these platforms, creating avoidable privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly recommends using a persistent browser profile directory to retain authenticated sessions, but it does not warn that this directory may contain sensitive session cookies, tokens, and browsing artifacts. In the context of an automation skill that logs into multiple third-party AI platforms, this increases the risk of credential theft, account takeover, and unintended reuse of privileged sessions if the local machine, repo, or backup location is exposed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The usage section instructs users to submit topics through automated workflows to multiple external AI services, but it omits any warning that prompts and derived content will be transmitted to third parties. In a multi-platform analysis tool, users may input sensitive research topics, internal data, or regulated information, so the lack of disclosure can lead to accidental data leakage across several providers at once.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document describes a workflow that automatically submits user-provided analysis topics to multiple third-party AI platforms and saves resulting reports locally, but it does not mention consent, data sensitivity checks, or user-facing disclosure about external transmission and file persistence. In a skill that automates browser interaction across several services, this omission creates a real risk of unintended data exfiltration and local storage of sensitive content.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document explicitly states that generated reports are saved to disk, but it does not warn users that their prompts and potentially sensitive model outputs will be persisted locally. In a multi-AI analysis workflow, this can expose confidential business data, credentials, or personal information if users assume the tool is ephemeral or if saved reports are stored insecurely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill automates submission of user prompts to multiple third-party AI platforms, but it does not disclose that user-entered content will be transmitted externally. This creates a meaningful privacy and data-governance risk because users may submit proprietary, regulated, or personal data without informed consent, and the data is replicated across several services rather than one.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document explicitly presents the skill as production-ready for automated interaction with multiple external AI platforms, including sending prompts and extracting responses, but it provides no warning about transmitting user-provided content to third-party services. In a skill context, this omission can cause operators to unknowingly send sensitive, proprietary, or regulated data outside the trust boundary, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The troubleshooting guidance tells users to run a recursive force-deletion command against browser-profile/* without any warning, backup advice, or validation step. This can destroy persisted browser data such as session state, cookies, or other profile contents, and if the path is mis-specified or expanded unexpectedly it could cause broader data loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README encourages sending prompts to four third-party AI services but does not warn users that their inputs may contain sensitive, proprietary, or regulated data that will be disclosed to multiple external providers. This increases confidentiality and compliance risk because a single user action replicates data exposure across several separate platforms with different retention, policy, and jurisdictional practices.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation states that browser login state is stored in a local browser-profile directory but does not warn that this data may persist authentication sessions or tokens on disk. If the host is shared, compromised, backed up insecurely, or the directory is mishandled, attackers could reuse those sessions to access the linked AI accounts.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The invocation examples use very broad, natural phrasing such as asking to analyze a topic with multiple AIs, without clear activation boundaries or confirmation gates. This can cause accidental triggering on ordinary user requests and may lead the agent to open multiple third-party sites and transmit prompts externally without the user fully understanding that cross-service actions will occur.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill’s core function is to send the same user question to multiple external AI platforms, some of which require authenticated sessions, but the documentation does not provide a clear privacy or data-sharing warning. This creates a real risk of exposing sensitive user data, proprietary information, or regulated content to several third parties at once, amplifying confidentiality and compliance impact.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs users to recursively delete the entire `browser-profile` directory as a troubleshooting step, but does not clearly warn that this removes persisted browser state such as login sessions, cookies, saved preferences, and possibly other local profile artifacts. In this skill context, that can cause unintended data loss and force reauthentication to external services, making the guidance operationally unsafe even if not malicious.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide documents a feature to save each AI platform's raw responses locally, but it does not clearly warn that those responses may contain sensitive user prompts, proprietary data, personal information, or regulated content. In this skill's context—multi-platform AI querying and report generation—local persistence meaningfully increases confidentiality and retention risk, especially if logs, raw outputs, or backups are stored on shared or unmanaged systems.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README instructs users to persist browser login state in a local profile directory but does not warn that this directory may contain cookies, session tokens, and other sensitive browsing artifacts. In the context of an automation skill that logs into multiple AI platforms, silently encouraging persistent profile storage increases the risk of credential theft, account takeover, or accidental disclosure if the directory is shared, backed up insecurely, or committed to source control.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The troubleshooting section tells users to run a recursive deletion command against the browser profile directory without warning that this will erase saved login sessions and potentially other local browser state. This is dangerous because users may lose account access context or delete the wrong path if the variable/directory is customized, especially in a security-sensitive workflow centered on authenticated browser automation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script creates and reuses a persistent browser profile directory to retain login state, but it does not clearly warn the user that authentication cookies, tokens, and browsing/session artifacts will be stored locally. On shared or poorly secured systems, this can expose account sessions to other local users or malware and increase the blast radius of endpoint compromise.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The tool automatically transmits user-supplied topics, dimensions, and follow-up prompts to multiple third-party AI services, but it does not provide a clear disclosure or confirmation that this content will leave the local machine. If users include confidential, regulated, or proprietary information, it may be exposed to external providers and logged under their retention policies.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code submits a real message to the Qwen service while describing the action as a harmless key test. In an automation context, unexpected outbound actions can leak prompts, create audit/log artifacts, trigger downstream processing, or violate user expectations and testing boundaries.

Known Vulnerable Dependency: tqdm — 3 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2016-10075 (TDQM Arbitrary Code Execution); CVE-2016-10075 (The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to e)

High

• Category: Supply Chain
• Confidence: 77% confidence
• Finding: The requirements entry allows any tqdm version >=4.66.0, and the static analysis reports known advisories affecting tqdm. In a skill that may process CLI-style inputs or run automation tooling, retaining a dependency with unresolved advisory status can expose users to command/argument injection or other unsafe behavior if a vulnerable version is installed or bundled.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 73% confidence
• Finding: The numpy dependency is only minimally constrained, and the scanner associates numpy with multiple historical advisories. While not every advisory will affect this skill's usage, allowing unresolved or vulnerable numpy versions increases supply-chain and local exploitation risk, especially in environments handling untrusted files or data during analysis and chart generation.

Static analysis

No suspicious patterns detected.