ClawHub
Back to skill

Security audit

Min Web Search

Security checks across malware telemetry and agentic risk

Overview

This skill is a small, disclosed Bing RSS web-search helper, with the main caution that search queries are sent to Bing.

Install only if you are comfortable with search terms being sent to Bing over the network. Do not search for secrets, credentials, private customer data, or confidential internal material with this skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs users to run scripts that perform outbound web requests and invoke shell-capable tooling, yet the manifest does not declare corresponding permissions. This creates a trust and policy-enforcement gap: platforms or reviewers relying on manifest permissions may underestimate the skill's network reach and command execution surface.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The README encourages use of a web search capability but does not clearly disclose that user queries are transmitted to Bing over the network. In an agent skill context, this can cause unintentional disclosure of sensitive prompts, internal data, or user-provided secrets if operators assume the tool is local or privacy-preserving.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.