ClawHub
Back to skill

Security audit

Power Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible web-search tool, but its Browserless setup and fetch path create review-worthy network exposure and private-network fetching risks.

Install only after constraining Browserless: bind it to 127.0.0.1, enable a token, avoid the latest image tag, add firewall/container limits, and block private, loopback, link-local, and metadata destinations before using --fetch or Telegram integration. Avoid sensitive searches unless you are comfortable sending queries to Brave and relaying fetched snippets through Telegram/OpenClaw infrastructure.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:47
Finding

Browserless Service Is Exposed Without Authentication

Content
View full analysis
Remediation
View remediation
``` - Enable Browserless token authentication and require the Node.js client to supply the token. - Apply host firewall rules that deny external access to port `3000`. - Isolate Browserless in a dedicated Docker network with restrictive outbound policy. - Set container CPU, memory, process, and request-concurrency limits. - Run the container without unnecessary Linux capabilities and with a read-only filesystem where compatible. - Replace `latest` with a reviewed version or immutable image digest. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/browserless.js:9
Finding

Unvalidated Browser Navigation Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/browserless.js:9
Finding

Configured Fetch Timeout Is Not Enforced

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/telegram-handler.js:19
Finding

Untrusted Search Content Is Inserted into Telegram Markdown Without Escaping

Content
View full analysis
{ message += `*[${idx + 1}]* ${result.title}\n`; message += `🔗 ${result.url}\n`; if (result.description) { message += `${result.description.substring(0, 200)}...\n`; } message += '\n'; }); return message; } ``` Fetched content is also embedded in Markdown code fences without escaping: ```javascript function formatFetchedContent(results) { let message = `📄 *Content from "${results.query}"*\n\n`; results.results.forEach((result, idx) => { message += `*[${idx + 1}]* ${result.title}\n`; message += `🔗 ${result.url}\n`; if (result.content) { const preview = result.content.substring(0, 300); message += `\`\`\`\n${preview}...\n\`\`\`\n`; } message += '\n'; }); return message; } ``` The result is explicitly interpreted as Markdown: ```javascript let response = { text: formatResults(searchResults, fetchMode), parse_mode: 'Markdown', }; ``` ### Technical Analysis The query, result title, URL, description, and fetched page text are untrusted external data. These values are inserted directly into a Telegram message that uses Markdown parsing. An attacker controlling indexed page metadata can introduce Markdown control characters that alter formatting or create deceptive links. Fetched content can contain backticks that terminate the intended code block. Invalid combinations of special characters may also cause Telegram to reject the entire message. ### Attack Path 1. An attacker creates a searchable page with crafted title, description, URL representation, or ...[truncated 651 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill description centers on web search and content fetching, but the document also exposes a Telegram/OpenClaw command surface (/search) that changes how the skill can be triggered and where data may flow. Undisclosed trigger surfaces are dangerous because they expand attack surface and may cause operators to deploy the skill into chat environments without realizing it processes user-supplied commands there.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill description centers on web search and content fetching, but the document also exposes a Telegram/OpenClaw command surface (/search) that changes how the skill can be triggered and where data may flow. Undisclosed trigger surfaces are dangerous because they expand attack surface and may cause operators to deploy the skill into chat environments without realizing it processes user-supplied commands there.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.24.7 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile pins undici to 7.24.7, and the finding indicates multiple published HIGH-severity advisories affecting that exact version. Even though undici is only a transitive dependency brought in via cheerio, this skill’s purpose is to fetch and parse attacker-controlled web content, which increases exposure to HTTP parsing, connection reuse, and response desynchronization flaws in the HTTP client stack.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search.js (reported line 7)May include surrounding context.

js
const BraveSearch = require('./brave-search');
const Browserless = require('./browserless');

// Get API key from environment or TOOLS.md
const BRAVE_API_KEY = process.env.BRAVE_API_KEY;
if (!BRAVE_API_KEY) {
  console.error('❌ Error: BRAVE_API_KEY environment variable not set');

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The markdown advertises Browserless content fetching and Telegram integration, both of which can transmit user queries or fetched content to external services. The README provides no warning about network/data-sharing behavior or privacy implications, which is expected for markdown descriptions of skills that affect user data or privacy.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents clear network use and environment variable access (Brave API key, Browserless, Telegram/OpenClaw) but does not declare any explicit tool scope or permissions boundary. That increases the risk of over-broad execution in an agent framework because operators and policy engines cannot easily constrain or review what external access the skill requires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user search queries to Brave Search and may send fetched URLs and page content through Browserless, but the user-facing description does not warn about this external transmission. In research workflows, queries and visited URLs can contain sensitive investigative or business information, so lack of disclosure creates privacy and compliance risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

bash
# Install Docker
sudo apt-get install docker.io docker-compose

# Start Browserless container
docker run -d --name browserless --restart unless-stopped \

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The installation instructions use a floating container image tag (browserless/chrome:latest), which makes deployments non-reproducible and can silently pull changed code in the future. If the upstream image is compromised or introduces unsafe behavior, users will run it without noticing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This skill intentionally transmits data to an external service endpoint (api.search.brave.com) as part of its core function. While expected, it is still a real security/privacy concern because user queries may reveal sensitive intent, and the skill documentation does not pair this behavior with sufficient disclosure or constraints.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
### 2. Brave Search API Key

Get a free key from [search.brave.com](https://api.search.brave.com/res/v1/):
- 100 free queries/day
- Set environment variable: `export BRAVE_API_KEY=your_key_here`

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/brave-search.js (reported line 6)May include surrounding context.

js
class BraveSearch {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.baseUrl = 'https://api.search.brave.com/res/v1/web/search';
  }

  async search(query, limit = 10) {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search-runner.js (reported line 17)May include surrounding context.

js
class BraveSearch {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.baseUrl = 'https://api.search.brave.com/res/v1/web/search';
  }

  async search(query, limit = 10) {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.js (reported line 12)May include surrounding context.

js
class BraveSearch {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.baseUrl = 'https://api.search.brave.com/res/v1/web/search';
  }

  async search(query, limit = 10) {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/telegram-handler.js (reported line 13)May include surrounding context.

js
class BraveSearch {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.baseUrl = 'https://api.search.brave.com/res/v1/web/search';
  }

  async search(query, limit = 10) {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code sends the user-provided query to an external Brave Search API and includes an API subscription token in the request headers. There is no confirmation prompt, user-facing log/print, or explanatory comment/docstring warning that user input and credentials are being transmitted off-system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code forwards a caller-supplied URL to a Browserless service, which causes that service to make network requests on the caller's behalf. Without validation, allowlisting, or disclosure, this can enable server-side request forgery behavior against internal services reachable by Browserless, and the self-hosted research context makes remote fetching a core feature rather than an accidental edge case.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a self-hosted research tool that combines Brave Search and Browserless for web search and content extraction. This file implements a Telegram/OpenClaw command handler and chat-response formatting layer, which is an integration capability not justified by the stated purpose and not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

When --fetch is used, the handler retrieves third-party page content and relays excerpts directly into Telegram without any consent, provenance warning, or content filtering. This can expose users to unintended data relay, including sensitive page contents from internal or authenticated browserless contexts, and can leak fetched material into an external chat system.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The document explicitly says the tool makes HTTP requests and calls external APIs, yet later states there are no unauthorized external communications. That wording contradicts the described behavior because external communication does occur; even if intended, the statement is overly absolute and misleading.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
62% confidence
Finding

Line L068 states 'Environment variables only' and says keys are never in code or '.env' files, but the next lines discuss '.env' protection and a '.env.example' as part of best practices. This creates intent/documentation inconsistency about whether users are expected to use .env files for secret handling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json
"author": "Kaito",
  "license": "MIT",
  "dependencies": {
    "node-fetch": "^2.7.0",
    "commander": "^11.1.0",
    "cheerio": "^1.0.0-rc.12"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "node-fetch": "^2.7.0",
    "commander": "^11.1.0",
    "cheerio": "^1.0.0-rc.12"
  }
}

Static analysis

No suspicious patterns detected.