The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The setup instructions utilize bunx to fetch and execute the ubersearch package from the npm registry. This is the standard and intended deployment method for this type of MCP tool.
[DATA_EXFILTRATION]: The skill documentation includes examples for configuring API keys for search providers (Tavily, Brave). It correctly uses placeholders like 'your_key' and instructs users to set these in environment variables, which follows security best practices for credential management.
[PROMPT_INJECTION]: Because the skill aggregates content from various web search engines, it inherently handles untrusted third-party data. This presents an indirect prompt injection surface where search results could contain instructions intended to influence the agent. No specific vulnerabilities were found in the skill's implementation, but the agent should treat external search results as untrusted content.

Unified Search