omnisearch

PassAudited by ClawScan on May 1, 2026.

Overview

OmniSearch appears to be a simple web-search wrapper, but it uses forceful auto-invocation language and sends search queries through external providers via an undeclared mcporter dependency.

Install this only if you want the agent to perform web searches through mcporter providers such as Perplexity, Brave, Kagi, Tavily, or Exa. Do not include secrets or highly private information in search queries, and verify the mcporter configuration before relying on it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

Your agent may run this search tool automatically for current-information requests rather than asking before using the web.

Why it was flagged

The skill uses forceful language that directs the agent to prefer this tool whenever current information or web search is involved.

Skill content
MANDATORY web search tool... This is THE ONLY way to search the internet... ALWAYS use this skill
Recommendation

Use it only if you want automatic web search behavior; edit or disable the skill if you prefer the agent to ask before searching.

What this means

Search terms, locations, names, or other details included in a query may be shared with the configured search provider.

Why it was flagged

The wrapper forwards the user-provided query through the mcporter gateway to a selected search provider, which is expected for search but means query text may leave the local environment.

Skill content
mcporter call omnisearch.ai_search query="$QUERY" provider="$PROVIDER"
Recommendation

Avoid putting secrets, private identifiers, or sensitive personal data in search queries unless you trust the configured provider and gateway.

What this means

Installation checks may not warn you that mcporter is required, and the skill will depend on whatever mcporter setup is already available.

Why it was flagged

The metadata does not declare runtime requirements, while the included documentation and script depend on mcporter being present and configured.

Skill content
Required binaries (all must exist): none... No install spec — this is an instruction-only skill.
Recommendation

Verify that mcporter is installed from a trusted source and configured only for the search providers you intend to use.