Derive one public key from ECDH when the other and and the shared secret is known
Is it possible for Carol to find Bobs key in $S_{pks}$

This is a decisional Diffie-Hellman problem.
We can summary this problem as: &quot;we're given the values $G, aG, abG$, and a series of values $c_1G, c_2G, ... c_nG$, can we recognize $c_iG = bG$&quot;
We can reword the problem as &quot;assuming $H = aG$, we're given the values $H, (a^{-1})H, bH$, can we recognize $c'_iH = (a^{-1}b)H$&quot;; with this rewording, this is obviously a DDH problem.
Hence, this problem is possible if the DDH problem is tractable; that is, if we're in a pairing-friendly curve, or if the group order has small factors, or the group order is small enough (or you have a large quantum computer handy).  If none of these are true, then it's believed hard.