ClawHub
Back to skill

Security audit

多引擎全自动搜索聚合器

Security checks for vulnerabilities and agentic risk

Overview

This search skill is disclosed as an aggregator, but it automatically runs broadly discovered local skill scripts with the user's agent privileges and weak isolation.

Review before installing. Use this only in an environment where every installed skill in the scanned OpenClaw skill directories is trusted, because a matching skill name can cause its Python code to run automatically. Avoid sensitive queries unless you are comfortable with Bing fallback and local temp-file handling, and prefer an updated version with an explicit allowlist, per-engine confirmation, and secure per-run temp files.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Error
Location
run.py:45
Finding

Automatic Execution of Untrusted Discovered Skill Scripts

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
run.py:12
Finding

Predictable Shared Temporary Files Allow Race Conditions and Result Spoofing

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill enumerates installed skills and executes those whose names heuristically look search-related, which is broader than a normal aggregation function and effectively creates an automatic code-execution orchestrator. The context makes this especially risky because any attacker-controlled skill dropped into the scanned directories can be triggered transitively by a benign search request.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill runs arbitrary discovered local scripts without warning or confirmation, so a normal search action can become execution of untrusted code from skill directories. In the skill context this is more dangerous than generic subprocess use because discovery heuristics are broad and no provenance checks are performed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly documents discovery and parallel subprocess execution of other installed skills from user-writable directories, but does not warn that this causes arbitrary local code execution in every matched script. In this context, the omission is security-relevant because an operator may treat it as a simple search aggregator while it actually expands trust to any similarly named installed skill, including malicious or trojanized ones.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented Bing fallback performs direct network access, but the skill description does not disclose that queries may be sent externally even when local skill execution yields no results. This is dangerous because users may unknowingly leak sensitive search terms or internal data to a third-party service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The docstring frames the skill as discovering and aggregating installed search skills, but the implementation also performs independent direct web retrieval. That mismatch reduces user ability to understand data flows and execution scope, which is dangerous in agent environments where hidden capabilities matter.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This skill has a built-in direct network fallback to Bing via curl that is not apparent from a pure 'aggregate installed search skills' description. That means user queries may be sent to an external service unexpectedly, creating privacy and policy bypass concerns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user queries directly to Bing through curl without clear disclosure, exposing query contents to a third party and potentially bypassing user expectations or local policy. This is particularly relevant for search queries, which often contain sensitive topics, identifiers, or internal research terms.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run.py (reported line 16)May include surrounding context.

python
def curl_get(url, timeout=12):
    """直接用curl抓取（不依赖任何skill，独立可用）"""
    try:
        r = subprocess.run(
            ['curl.exe', '-s', '-L', '--max-time', str(timeout),
             '-H', 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
             '-H', 'Accept-Language: zh-CN,zh;q=0.9', url],

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The HTTP request hard-codes the Accept-Language header to 'zh-CN,zh;q=0.9', imposing a specific language/locale on results. There is no evidence of user opt-in or documentation that this skill is intentionally region-specific, so this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The code writes the user's query to a predictable temporary file without telling the user, which can leak potentially sensitive search terms to other local processes or linger on disk. Predictable shared temp paths also create opportunities for collisions and tampering in multi-process environments.

Content

No source excerpt is available for this finding.

Tainted flow: 'infile' from os.environ.get (line 73, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
77% confidence
Finding

The temporary input file path is derived from the TEMP environment variable and the code writes user query data there without validating the directory or using a secure temporary-file API. In hostile local environments this can enable data exposure, file clobbering, or symlink/hardlink abuse against predictable filenames.

Content

Scanner excerpt · run.py (reported line 74)May include surrounding context.

python
# 写临时文件，传递查询词（解决中文编码问题）
    infile = os.path.join(os.environ.get('TEMP', '/tmp'), 'mes_in.json')
    with open(infile, 'w', encoding='utf-8') as f:
        json.dump({'query': query}, f)

    try:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This code executes another discovered local skill script as a subprocess based on filesystem discovery, which expands the skill's authority from search aggregation into arbitrary local code execution of any matching installed skill. In this context, a malicious or trojanized 'search-like' skill placed in the scanned directories would be run automatically when this skill is used.

Content

Scanner excerpt · run.py (reported line 80)May include surrounding context.

python
try:
        if stype == 'run':
            # 调用 run.py，传查询词
            result = subprocess.run(
                [sys.executable, path, query, '--json'],
                capture_output=True, text=True, timeout=20,
                encoding='utf-8', errors='replace'

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

Like the other subprocess path, this launches discovered search.py scripts from local skill directories without trust validation or consent. That creates a direct execution path for untrusted local code and makes the aggregator dangerous in environments where installed skills are not strictly vetted.

Content

Scanner excerpt · run.py (reported line 87)May include surrounding context.

python
)
        else:
            # search.py 类型
            result = subprocess.run(
                [sys.executable, path, '--query', query, '--max-results', '8'],
                capture_output=True, text=True, timeout=20,
                encoding='utf-8', errors='replace'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The title and description present the skill as a Chinese-language variant (including '全引擎自动聚合搜索' and later references to Chinese encoding/Bing CN) without indicating any user choice of language or locale. This can violate language/locale policy when the skill implicitly constrains behavior to a specific locale without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.