ClawHub
Back to skill

Security audit

xAI Search

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it sends user-entered search queries to xAI/Grok for web and X/Twitter search, with no hidden persistence or unrelated local access found.

Install this only if you are comfortable sending search queries to xAI/Grok and using an `XAI_API_KEY` in the environment. Avoid confidential, regulated, or secret content in queries unless your organization allows that provider, and consider installing `xai-sdk` in a virtual environment with a pinned reviewed version.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party SDK Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–16
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

markdown
## Requirements

- `XAI_API_KEY` environment variable
- Python 3 + xai-sdk: `pip install xai-sdk`

The installed package is subsequently imported and executed by scripts/xai-search.py, lines 14–18:

python
try:
    from xai_sdk import Client
    from xai_sdk.chat import user
    from xai_sdk.tools import web_search, x_search
except ImportError:

Technical Analysis

The installation command does not pin xai-sdk to a reviewed version and does not use a lockfile, cryptographic hashes, or other integrity controls. Consequently, the exact package code and transitive dependency graph can change between installations without any corresponding change to this project.

Installing a Python package may execute package build or installation logic. Importing the package also executes its module initialization code. If a future package release or transitive dependency is compromised, users following the documented installation command could execute attacker-controlled code under their own account.

This is a supply-chain hardening weakness rather than evidence that the currently published xai-sdk package is malicious.

Attack Path

  1. An attacker compromises the upstream xai-sdk distribution account, its build or release pipeline, or one of its unpinned transitive dependencies.
  2. The attacker publishes a malicious version that is accepted by the unrestricted pip install xai-sdk command.
  3. A user follows the instructions in SKILL.md and installs the dependency.
  4. Malicious code executes during package installation or when xai_sdk is imported by the helper script.
  5. The code operates with the permissions and environmental access of the user running pip or the script.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the ...[truncated 407 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin xai-sdk to a specifically reviewed version, using an exact constraint such as:

    text
    xai-sdk==<reviewed-version>

  2. Provide a locked dependency file that also fixes transitive dependency versions.

  3. Add cryptographic hashes and require hash verification during installation, for example through a generated requirements file used with:

    bash
    python -m pip install --require-hashes -r requirements.txt

  4. Install the dependency in a dedicated virtual environment rather than into the system Python environment.

  5. Document the expected official package source and use an explicitly configured trusted package index.

  6. Establish an update process in which new SDK and transitive dependency versions are reviewed and tested before changing the lockfile and hashes.

  7. Avoid running package installation with administrative or root privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill requires access to an environment secret (XAI_API_KEY) but does not declare any explicit tool scope or permissions boundary in the skill metadata. That omission weakens reviewability and least-privilege enforcement, making it easier for a consuming agent or user to invoke the skill without a clear declaration that it depends on secrets and external network access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description explains search functionality but does not clearly warn that user queries are transmitted to xAI's external API provider. In this context, users may paste sensitive prompts, internal URLs, or private investigation terms into what appears to be a simple local skill, causing unintended third-party disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example explicitly sends user-supplied content to https://api.x.ai/v1/chat/completions, which is an external transmission of potentially sensitive data. Although this is the intended function of a search skill, it is still security-relevant because prompts, search terms, and possibly investigative context leave the local environment and are processed by a third party.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Web Search

bash
curl -s https://api.x.ai/v1/chat/completions \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example explicitly sends user-supplied content to https://api.x.ai/v1/chat/completions, which is an external transmission of potentially sensitive data. Although this is the intended function of a search skill, it is still security-relevant because prompts, search terms, and possibly investigative context leave the local environment and are processed by a third party.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Web Search

bash
curl -s https://api.x.ai/v1/chat/completions \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The X/Twitter search example also transmits user query content to xAI's external API endpoint. This can expose sensitive interests, monitoring targets, or internal investigative topics to a third party even though the behavior matches the skill's advertised purpose.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

X/Twitter Search

bash
curl -s https://api.x.ai/v1/chat/completions \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The X/Twitter search example also transmits user query content to xAI's external API endpoint. This can expose sensitive interests, monitoring targets, or internal investigative topics to a third party even though the behavior matches the skill's advertised purpose.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

X/Twitter Search

bash
curl -s https://api.x.ai/v1/chat/completions \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The combined web and X example sends prompts externally and broadens collection scope by enabling multiple search tools in one request. In context, that increases the chance that user input, research topics, or sensitive context are disclosed to the remote provider and correlated across sources.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Combined (Web + X)

bash
curl -s https://api.x.ai/v1/chat/completions \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The combined web and X example sends prompts externally and broadens collection scope by enabling multiple search tools in one request. In context, that increases the chance that user input, research topics, or sensitive context are disclosed to the remote provider and correlated across sources.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Combined (Web + X)

bash
curl -s https://api.x.ai/v1/chat/completions \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code sends the user's query to external web/X search tools through the xAI client, which may transmit user-provided data off-system. While network access is central to the script's purpose, there is no explicit disclosure in code comments or runtime messaging that the query will be sent to third-party services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.