agnxi-search
3 findings (1 high, 2 medium), mainly prompt injection, resource abuse, social engineering. Most recent scan 2026-02-05.
This skill presents HIGH security risks primarily due to unvalidated network requests to external sources and transitive trust vulnerabilities. The skill fetches and parses content from https://agnxi.com/sitemap.xml without user consent, content validation, or disclosure of network activity. This creates both data exfiltration risks (outbound HTTP requests leak metadata) and indirect prompt injection risks (compromised sitemap could inject malicious URLs). The lack of timeout/size limits on network requests creates denial-of-service vulnerabilities. Additionally, the skill's description is misleading as it does not disclose the network dependency, violating user expectations of transparency. While the core functionality (searching a directory) is legitimate, the implementation lacks critical security controls for handling external data and network operations.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco rates this HIGH and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
The official search utility for Agnxi.com - The premier directory of AI Agent Tools, MCP Servers, and Skills.
- Package
- 3 files, 5.8 KB
- SKILL.md
- 192 words, 5 sections
- Code
- Python (1)
- Version
- 1.1.0
SKILL.md covers: Agnxi Search Skill · Capabilities · Tools · `search_agnxi` · Best Practices for Agents
Findings
HIGH Indirect Prompt Injection via Untrusted External Sitemap Content Prompt Injectionllm
The skill fetches XML content from an external URL (agnxi.com/sitemap.xml) and parses it as trusted data without validation. If the sitemap is compromised or the domain is hijacked, an attacker could inject malicious URLs or XML content that the agent would then present to the user or follow. The skill treats external web content as authoritative, creating a transitive trust vulnerability where the agent delegates trust to an external, unverified source.
search.py
def parse_sitemap(xml_content, query):
try:
root = ET.fromstring(xml_content)
# Parses external XML without validation
for url in root.findall('ns:url', namespace):
loc = url.find('ns:loc', namespace).text
results.append(loc) # Returns URLs from external sourceMEDIUM Unbounded Network Request Without Timeout or Size Limits Resource Abusellm
The urllib.request.urlopen() call lacks timeout parameters and response size limits. An attacker controlling the sitemap URL could cause a denial-of-service by serving an extremely large XML file, never responding (causing indefinite hang), or responding very slowly to exhaust agent resources. This could freeze the agent or consume excessive memory/bandwidth.
search.py:14
with urllib.request.urlopen(SITEMAP_URL) as response:
return response.read() # No timeout, no size limitMEDIUM Misleading Description - Network Activity Not Disclosed Social Engineeringllm
The skill description claims to be 'The official search utility for Agnxi.com' but does not disclose that it makes live network requests to external servers. The YAML manifest lacks 'compatibility' and 'allowed-tools' fields that would inform users about network dependencies. Users may assume this is a local-only search tool when it actually performs external HTTP requests on every invocation.
SKILL.md
description: The official search utility for Agnxi.com - The premier directory of AI Agent Tools, MCP Servers, and Skills.
# Missing: compatibility field should mention 'requires network access'
# Missing: allowed-tools field (should include Python and network capabilities)What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 1.7 KB |
SKILL.md | doc | 1.6 KB |
search.py | script | 2.5 KB |
External hosts referenced
agnxi.com github.com img.shields.io www.sitemaps.org
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/agnxi-search-skill
- Raw scan result: agent-skills-search-scan.json
- Badge for your README:
- Request a re-scan