T08 · Insecure Dependencies
Warning
- Location
SKILL.md:11- Finding
Unpinned and Unnecessary Third-Party Dependencies Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Web Search Hub
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does web search as advertised, but it asks users to install an apparently unused external CLI and an unpinned Python package before use.
Review before installing. Use a virtual environment, avoid administrator privileges, pin and verify the duckduckgo-search dependency if possible, and question the OpenClawCLI prerequisite unless your runtime specifically requires it. Do not send secrets, private project names, or sensitive personal data as search queries.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as a web-search helper, but the documented behavior includes installation of external software from
clawhub.aiand writing arbitrary output files without clearly declaring those capabilities in the metadata. This mismatch can mislead operators about trust boundaries and increase supply-chain and filesystem risk during invocation.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents use of
--outputand workflows that write files, but it does not declare any tool scope such aspermissionsorallowed-tools. Undeclared write capability weakens least-privilege controls and can cause agents or reviewers to underestimate the skill’s ability to persist data to disk.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are extremely broad, covering many common requests like research, fact-checking, or anything needing current content. Overbroad invocation increases the chance that this skill is selected when a safer built-in tool or a less-privileged workflow would suffice, expanding exposure to external dependencies and file-write behavior unnecessarily.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This tool sends raw user search queries to DuckDuckGo via an external library, but the script does not clearly warn users that their input leaves the local environment. In an agent-skill context, users may provide sensitive research topics, internal project names, or personal data, creating a privacy and data-handling risk if the transmission is not made explicit.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill for searching the web for information, news, images, or videos. In addition to performing searches, the code exposes an --output option and writes formatted results to a caller-specified file path, which goes beyond pure search/retrieval behavior and introduces local filesystem modification.
- Content
Static analysis
No suspicious patterns detected.