ClawHub
Back to skill

Security audit

Openclaw Search

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward external search skill that uses an AIsa API key and sends user search queries or URLs to AIsa/Tavily-backed endpoints, with no evidence of hidden persistence, local data harvesting, or destructive behavior.

Install only if you are comfortable sending search terms, URLs, and selected result data to AIsa/Tavily-backed external APIs using your AISA_API_KEY. Avoid using it for confidential internal names, private URLs, or sensitive investigations unless your organization approves that data flow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The usage guidance is broad enough to match many generic user requests such as search, synthesis, competitor scans, or trend discovery, which can cause the skill to be invoked more often than intended. In an agent ecosystem, over-triggering a web-research skill increases the chance of unnecessary external retrieval, unintended data exposure to third-party services, and reduced operator control over when networked research behavior occurs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares required environment access and implicitly performs network-backed research, but it does not define an explicit tool scope such as permissions or allowed-tools. This can cause the host agent to invoke the skill with broader capabilities than necessary, increasing the risk of unintended secret exposure or network use beyond user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The top-level description is broad enough to match many ordinary requests involving search, synthesis, competitor analysis, or trend discovery. Overbroad routing guidance can cause the agent to select this skill too often, sending user prompts to an external service unnecessarily and expanding data exposure to third-party infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The "When to use" section provides loose trigger criteria without meaningful constraints, which increases the chance of accidental invocation for generic research or comparison tasks. In this skill's context, unnecessary invocation matters because the skill depends on network access and an API key, so misrouting can leak prompts or sensitive context to an external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_client.py (reported line 30)May include surrounding context.

python
class SearchClient:
    """OpenClaw Search - Web and Academic Search API Client with Confidence Scoring."""
    
    BASE_URL = "https://api.aisa.one/apis/v1"
    
    def __init__(self, api_key: Optional[str] = None):
        """Initialize the client with an API key."""

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

User-supplied queries and URLs are sent to an external service, but the CLI provides no disclosure, consent prompt, or data-handling warning. In agent workflows, users may unknowingly submit sensitive internal terms, URLs, or research targets to a third party, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes a search/research skill for web, multi-source, or recent research through AIsa, which reasonably covers querying and synthesis. However, tavily_crawl and tavily_map extend into recursive website exploration and sitemap generation, which are broader collection capabilities not stated in the manifest description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

A search skill is expected to submit queries and retrieve results, and URL extraction is still adjacent to structured retrieval. Recursive crawling introduces a stronger capability to traverse websites beyond direct search retrieval, which is not explicitly justified by the manifest's stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The explain_results method hard-codes language='en' as the default, which creates an English-by-default behavior without exposing a user choice in this file's CLI. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.