The Agent Skills Directory

Remote Code Execution (HIGH): The skill contains instructions to pipe the output of a network request from a local port directly into the python3 interpreter (curl | python3). This pattern, even with the -m json.tool flag, is a high-risk vector flagged by security scans that could allow arbitrary code execution if the local service is compromised or spoofed.
Command Execution (HIGH): The skill extracts parameters (pwd_id) from an untrusted third-party search API (s.panhunt.com) and interpolates them into URLs used to control a local desktop application (localhost:9128). The lack of sanitization or validation on these parameters allows a malicious search result to potentially exploit the local application.
External Downloads (MEDIUM): The skill relies on https://s.panhunt.com, an unofficial and unverifiable third-party aggregation service, as its primary data source.
Indirect Prompt Injection (LOW): The skill ingests untrusted metadata from search results without boundary markers or sanitization. Evidence Chain: 1. Ingestion: Search results from PanSou API. 2. Boundary markers: Absent. 3. Capability inventory: Local app interaction via curl and network requests. 4. Sanitization: Absent.

quark-search