Agent Economy ReportAgent Economy ReportCAUTION version 2.0.0 · audited 2026-09-09
This package is documentation only — there is no executable code, just a SKILL.md that tells an agent how to connect to the AnySearch remote MCP search service (web search, vertical/domain search, batch search, and URL-to-Markdown extraction). All network destinations belong to the vendor (api.anysearch.com) plus links to GitHub proxy tools; nothing is sent to unrelated third parties. Two things deserve a look before installing: the skill tells the agent it 'MUST' create an account on the user's real email address via a single curl call and then store the returned plaintext API key into config files, and it instructs the agent to relay a message coaching the user to mark AnySearch email as 'Not Spam'. The stdio/SSE setups use 'npx -y mcp-remote' / 'npx -y supergateway', which downloads and runs third-party npm packages at launch. Because the skill's tools pull arbitrary web pages and search results into the agent's context (up to 50,000 characters per page), it is a natural channel for indirect prompt injection from untrusted websites. No credential theft, obfuscation, persistence, or payment redirection appears anywhere in the files.
Instructions try to steer the agent beyond the declared purpose. The 'extract' tool returns up to 50,000 characters of arbitrary web page content into the agent context (SKILL.md line 374), and search tools return remote Markdown, so untrusted site text can reach the model. The skill document itself also issues binding-sounding directives to the agent, e.g. SKILL.md line 51 'On success the agent MUST:' and line 55, which tells the agent to relay a message coaching the user to whitelist the vendor's email.
| Declared purpose | A configuration/usage guide for the AnySearch MCP server, providing agents with real-time web search, vertical domain search, parallel batch search, and URL content extraction as Markdown. |
| Observed behavior | Pure documentation: JSON config snippets for OpenCode, Claude Desktop, Cursor, Windsurf, VS Code Copilot and Cline pointing at https://api.anysearch.com/mcp with an Authorization: Bearer header; a curl command to register an account and receive a one-time API key; instructions for the agent to persist that key; and descriptions of four remote tools (search, get_sub_domains, batch_search, extract). No scripts, no local file writes performed by the package itself, no encoded blobs. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: ANYSEARCH_API_KEY |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | All traffic goes to the vendor's own endpoints (api.anysearch.com/mcp for search, api.anysearch.com/v1/auth/email/register for signup). Search queries, target URLs and extracted page content are sent to AnySearch. |
| shell | needed | A bash/curl snippet (SKILL.md line 21-25) for account registration, and npx commands to launch stdio/SSE proxies. |
| credentials | needed | Handles an ANYSEARCH_API_KEY; the agent is instructed to place the one-time plaintext key into MCP config and/or an environment variable. The key is the skill's own credential, not the user's other secrets. |
| install_packages | exceeds purpose | 'npx -y mcp-remote' and 'npx -y supergateway' fetch and execute third-party npm packages at agent startup; only needed for clients lacking Streamable HTTP support. |
| filesystem_write | needed | The agent is told to write the API key into client config files (opencode.json, claude_desktop_config.json, .env). No writes are performed by the package itself. |
| browser | needed | The 'extract' tool fetches arbitrary http/https URLs server-side and returns page content as Markdown to the agent. |
| severity | finding |
|---|---|
| medium | Agent-initiated account creation with the user's real email address The skill instructs the agent to submit the user's real email to the vendor to auto-create an account and receive an API key. This sends personal data (email) to a third party and produces an account plus a mailed password without any verification step. Should only happen with explicit user consent. SKILL.md:22 curl -s -X POST "https://api.anysearch.com/v1/auth/email/register" \ |
| low | Imperative instructions aimed at the agent The document uses mandatory language to direct agent behavior (persist key, relay a specific message). It does not attempt to override safety rules or other tools, but users should note the skill text is trying to script agent actions rather than merely describe an API. SKILL.md:51 On success the agent MUST: |
| low | Agent asked to write a secret into configuration files A plaintext API key is to be stored by the agent into client config or environment. This is normal for API setup but means the agent modifies configuration files and holds a credential; the key could end up committed to shared configs. SKILL.md:53 Put `data.api_key.key` into the MCP server config as the `Authorization: Bearer <key>` value (and/or set `ANYSEARCH_API_KEY`) |
| low | Agent instructed to coach the user into whitelisting vendor email The skill scripts a message that asks the user to move vendor mail out of spam. This benefits the vendor's deliverability and is unrelated to the search functionality; it is mild social engineering delivered through the agent. SKILL.md:55 You may need to mark it as "Not Spam" to ensure future emails arrive correctly. |
| low | Server can return new credentials that the agent persists The remote service may hand back a freshly registered API key when quota runs out, and the agent is told to save it. Credential material therefore flows from the server into local config; the skill does ask for user confirmation first. SKILL.md:88 | Key exhausted, auto-registered key returned | Agent should ask user for confirmation, then persist the new key | |
| medium | Download-and-run third-party npm proxies at startup Configurations use 'npx -y mcp-remote' and 'npx -y supergateway', which fetch the latest version of those packages from npm and execute them each launch, with the API key passed on the command line. Supply-chain risk from unpinned versions, and the key may be visible in the process list. SKILL.md:193 "command": "npx", |
| medium | Untrusted web content enters the agent context The extract and search tools inject large amounts of remote, attacker-controllable text into the agent. For an agent holding credentials or able to spend money, this is a standard indirect prompt-injection vector and warrants restricting what the agent may act on from search output. SKILL.md:374 Fetch full page content from a URL and return as Markdown. Truncated at 50,000 characters. HTML pages only. |
| info | Vendor discloses data flow to its own service The publisher acknowledges that queries, fetched URLs, page content and registration email are transmitted to AnySearch. This is consistent with the observed configuration and is disclosed rather than hidden. skill-card.md:20 Risk: AnySearch receives submitted searches, extracted URLs and page content, and optional registration email or API key data. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| anysearch.com | not in the service index | SKILL.md:71 |
| api.anysearch.com | not in the service index | SKILL.md:22 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| github.com | not in the service index | SKILL.md:185 |
| opencode.ai | not in the service index | SKILL.md:123 |
| www.anysearch.com | not in the service index | SKILL.md:36 |
| www.apache.org | not in the service index | LICENSE:3 |
| Binaries invoked | bash, curl, npx |
| Environment variables read | ANYSEARCH_API_KEY |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
LICENSE | 199 | 6ec10776eb3899e7… |
NOTICE | 4 | 62b0a542344f2c54… |
SECURITY.md | 49 | 5aa051400e37b350… |
SKILL.md | 378 | 57c6d30ee242a168… |
_meta.json | 6 | fb61477d83e9df7f… |
skill-card.md | 46 | 79607fbbfd058be9… |
For agents
JSON: https://agenteconomy.report/k/anysearch-mcp.audit.json · badge: https://agenteconomy.report/k/anysearch-mcp.audited.svg ·
skill rating: /k/anysearch-mcp · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).