qwen-mm-plugins-search
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The image_search tool uploads local image files to uguu.se, a public third-party file hosting service, to enable reverse image searches. This effectively moves private local data to a public web infrastructure.
- Evidence: references/video_search.md states 'Searching a local image uploads it to the third-party public host uguu.se'.
- Mitigation: The skill instructions mandate that the agent must 'ask the user for consent and pass allow_public_upload=true only after they approve', which provides a significant barrier against accidental data exposure.
- [PROMPT_INJECTION]: The skill ingests untrusted data from the open web, making it susceptible to indirect prompt injection attacks.
- Ingestion points: The web_search and web_extractor tools (SKILL.md and references/video_search.md) retrieve content from external URLs.
- Boundary markers: There are no specific instructions or delimiters mentioned to distinguish retrieved content from system instructions.
- Capability inventory: The agent uses retrieved data to 'verify identity/facts' and inform its final response to the user.
- Sanitization: The instructions do not specify any sanitization or filtering logic for the content fetched by the web tools.
Audit Metadata