ClawHub
Back to skill

Security audit

Performs web searches using DuckDuckGo to retrieve real-time information from the internet. Use when the user needs to search for current events, documentation, tutorials, or any information that requires web search capabilities.

Security checks across malware telemetry and agentic risk

Overview

This appears to be a straightforward DuckDuckGo search skill, with normal external-search privacy considerations but no evidence of hidden or harmful behavior.

Install only if you are comfortable with a Python-based search skill that can send search terms to DuckDuckGo and any configured proxy. Do not use it for secrets, credentials, private personal data, or confidential business material.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill grants Bash-based Python, pip, and uv execution in addition to the nominal DuckDuckGo search capability, which expands the attack surface far beyond simple web search. In an agent setting, this can enable arbitrary code execution, package installation, and environment modification if the skill is invoked or repurposed with untrusted inputs.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill does not clearly warn that user queries, regions, time filters, and possibly proxy-routed traffic are transmitted to external network services. In an agent environment, users may provide sensitive prompts expecting local handling, causing unintended data disclosure to third parties.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.