ClawHub
Back to skill

Security audit

Doi Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward DOI lookup helper that uses curl to query DOI.org and Crossref, with no hidden persistence or privileged behavior found.

Installers should understand that DOI values, search terms, and any optional contact email placed in the User-Agent will be sent to DOI.org or Crossref. Use a public contact alias if adding mailto information; otherwise the skill appears proportionate for DOI metadata lookup.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
disponível:

```bash
curl -sG "https://api.crossref.org/works" \
  -H "User-Agent: OpenClaw doi-search (mailto:<email>)" \
  --data-urlencode "query=<termos>" \
  --data-urlencode "rows=5"
Confidence
79% confidence
Finding
The optional instruction to include a `mailto:<email>` value in the User-Agent can cause disclosure of an operational email address to an external service. If that email is drawn from internal configuration or organizational context, it may unnecessarily expose contact details and increase phishing or enumeration risk.

Static analysis

No suspicious patterns detected.