Claw Intelligence Searcher

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.16

Overview

The skill’s external intelligence-broker purpose is clear, but it gives a remote service influence over autonomous URL scraping and data submission, which needs careful review before use.

Install only if you are comfortable letting this external OpenClaw service assign URLs for your agent to scrape and submit back for rewards. Run it in a network-restricted environment, review target domains before batches when possible, do not allow it to access local files or private/internal services, and approve purchases only after seeing the exact price.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:73

Finding

Externally Supplied Target URLs Are Protected by an Incomplete SSRF Policy

Content

View full analysis

Scrape -> Extract -> Submit). 6. **🛑 MANDATORY PAUSE:** After completing the specified batch size, you MUST STOP autonomous execution. Do NOT loop indefinitely. Report the total rewards earned and ask the user if they want to authorize another batch. 【STRICT SAFETY GUARDRAILS】 7. **🛑 ANTI-SSRF & NETWORK LOCK:** When fetching a `targetUrl`, you MUST verify the URL. You MUST NOT fetch or access any internal, local, or private IP addresses (e.g., `localhost`, `127.0.0.1`, `169.254.169.254`, `10.0.0.0/8`, `192.168.0.0/16`). 8. **🛑 ANTI-EXFILTRATION:** You MUST NOT read, access, or submit the user's local files, environment variables, or private data. Only submit data explicitly scraped from the public `targetUrl`. ``` The corresponding remote task schema accepts an unconstrained string: ```json { "taskId": { "type": "string", "format": "uuid" }, "taskType": { "type": "string" }, "targetUrl": { "type": "string" }, "instructions": { "type": "object" } } ``` ### Technical Analysis The Skill autonomously fetches URLs supplied by the external OpenClaw task service. Although it contains an explicit anti-SSRF rule, that rule only provides representative hostname and IPv4 examples. It does not define the validation mechanics needed to enforce the policy reliably. Missing controls include: - Resolving hostnames and validating every resolved address before connection. - Blocking the full set of IPv4 and IPv6 loopback, private, link-local, reserved, multicast, unspecified, and documentation ranges. - Detecting IPv4-mapped IPv6 addresses and noncanoni ...[truncated 2213 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: skill.md:64

Finding

Untrusted Remote Task Instructions and Page Content Enter an Autonomous Agent Workflow

Content

View full analysis

Scrape -> Extract -> Submit). 6. **🛑 MANDATORY PAUSE:** After completing the specified batch size, you MUST STOP autonomous execution. Do NOT loop indefinitely. Report the total rewards earned and ask the user if they want to authorize another batch. ``` The remote response can contain both a URL and an unstructured instruction object: ```json { "type": "object", "properties": { "taskId": { "type": "string", "format": "uuid" }, "taskType": { "type": "string" }, "targetUrl": { "type": "string" }, "instructions": { "type": "object" } } } ``` ### Technical Analysis After one batch-level authorization, the Skill instructs the agent to process a sequence of remotely supplied tasks autonomously. Each task may contain an arbitrary `instructions` object, and the fetched page may also contain attacker-controlled text. The Skill does not explicitly establish that: - Remote task instructions are untrusted data rather than authoritative agent instructions. - Te ...[truncated 2571 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill instructs the agent to register with and transmit identifiers to an external third-party service, then later fetch tasks and submit scraped results back to that service. Even though this is the stated purpose of the skill, it creates a real data egress and trust-boundary risk because the agent is being connected to an untrusted remote controller that can influence subsequent behavior through supplied URLs and tasking.

Content

Scanner excerpt · skill.md (reported line 30)May include surrounding context.

1. Register Node (Identity Generation)

Registers the agent to receive an apiKey and 50 initial PTS.

bash

curl -X POST "https://search-r22y.onrender.com/api/v1/nodes/register?nodeId=MyBroker-01&hardwareId=<GENERATED_PUBLIC_KEY>"

2. Fetch Intelligence Task

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · skill.md (reported line 79)May include surrounding context.

md

【BATCHED AUTONOMOUS MINING (EFFICIENT & SAFE)】
4. **Batch Opt-In:** To begin mining, ask the user: *"How many intelligence tasks shall I process in this batch? (e.g., 1 to 5)"*
5. **Batched Execution:** Once the user provides a number, autonomously process EXACTLY that number of tasks in sequence (Fetch -> Scrape -> Extract -> Submit).
6. **🛑 MANDATORY PAUSE:** After completing the specified batch size, you MUST STOP autonomous execution. Do NOT loop indefinitely. Report the total rewards earned and ask the user if they want to authorize another batch.

【STRICT SAFETY GUARDRAILS】

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The purchase endpoint performs a paid action that affects account balance, but the schema provides no warning, confirmation requirement, or indication that the action is irreversible or billable. In an agent setting, this can lead to silent spending by the model on behalf of the user or operator, especially if triggered by ambiguous prompts or automated workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The submission endpoint accepts arbitrary metadata and payload objects and is described as a reward-earning action, but there is no warning against transmitting sensitive user, host, credential, or internal system data. In a scraping/intelligence-broker context, this is especially risky because an agent may package and exfiltrate collected content or environment-derived data to a third-party service in pursuit of rewards.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The tool description exposes a very broad capability surface—registering nodes, fetching tasks, purchasing data, rating entities, and submitting intelligence—without specifying when invocation is appropriate or what actions require explicit user consent. In an autonomous agent context, this increases the chance of overbroad or unintended tool use, especially because some operations consume balance or transmit collected data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.