ClawHub
Back to skill

Security audit

duckduckgo-search-skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward DuckDuckGo search helper; it sends search queries to DuckDuckGo, but I found no hidden persistence, credential access, destructive behavior, or unrelated data handling.

Install only if you are comfortable sending search terms to DuckDuckGo. Avoid searching for secrets, private internal identifiers, or sensitive prompts, and treat the --fetch-content option as nonfunctional in this version.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The declared description says the skill performs DuckDuckGo search, but the documentation also describes summarization, metadata extraction, and optional webpage content fetching, including a feature that appears not to be implemented. This mismatch can mislead users and agent policy layers about what data leaves the system and what processing occurs, increasing the risk of unintended data disclosure or unsafe automation behavior.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises and demonstrates network-capable behavior but does not declare any tool scope such as permissions or allowed-tools. In agent environments, missing scope declarations reduce transparency and can allow broader-than-expected network access, making it harder for users or orchestrators to apply least-privilege controls.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The README switches into Chinese for the primary usage instructions, examples, and parameter documentation, which implicitly constrains the skill's operating language. The policy explicitly disallows forcing a specific language without user opt-in, and there is no indication that users may choose another language or locale.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation describes sending user queries to DuckDuckGo and optionally fetching external webpage content, but it does not clearly warn that user-provided queries and retrieved content are transmitted to third-party services. This can lead to accidental disclosure of sensitive prompts, identifiers, or internal research targets, especially in agent workflows where users may assume local-only processing.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The file description and all user-facing CLI text are written in Chinese, and the HTTP request explicitly sets `Accept-Language` to prefer `zh-CN`. There is no option for the user to choose a different language or locale, so the skill imposes a locale preference rather than offering opt-in.

External Transmission

Medium
Category
Data Exfiltration
Content
使用 DuckDuckGo Instant API（只返回即时答案，不是完整搜索）
    适合事实性问题
    """
    url = "https://api.duckduckgo.com/"
    params = {
        "q": query,
        "format": "json",
Confidence
91% confidence
Finding
The skill transmits user-supplied queries to an external third-party service (DuckDuckGo) over the network. In an agent context, those queries may contain sensitive prompts, internal data, secrets, or user-identifying information, so the external transmission creates a real confidentiality and privacy risk even though it is core to the tool's purpose.

Description-Behavior Mismatch

Low
Confidence
98% confidence
Finding
The module docstring says it 'supports key information extraction and AI summarization,' and the CLI exposes a '--fetch-content' option for 'grabbing webpage content' (L373-L374). However, the 'fetch_content' parameter is passed through search_html into parse_html_results and then ignored; no code actually requests result URLs or extracts page bodies.

Intent-Code Divergence

Low
Confidence
99% confidence
Finding
The argument help explicitly states that the option will 'fetch webpage content,' which describes an additional behavior beyond search-result parsing. In practice, no logic uses 'fetch_content' to retrieve any page content, so the inline documentation is actively misleading about what the flag does.

Static analysis

No suspicious patterns detected.