Back to skill

Security audit

Smart Web Search

Security checks for vulnerabilities and agentic risk

Overview

This search skill is mostly purpose-aligned, but its very broad activation phrases and under-disclosed query, routing, and feedback data handling deserve manual review before installation.

Install only if you are comfortable with ordinary search requests being automatically sent to multiple external search providers. Avoid entering secrets, private identifiers, medical/financial details, or proprietary queries unless the platform shows which provider will receive them. The publisher should narrow triggers, document provider routing consistently, and add explicit privacy terms for feedback, logging, screenshots, and analytics before this should be treated as low-risk.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (43)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
# 网络恢复后执行
cd github/davidme6/openclaw-skills
git push -u origin master
```

---
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
# 网络恢复后执行
cd github/davidme6/openclaw-skills
git push -u origin master
```

---
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

High
Confidence
97% confidence
Finding
The trigger list includes very broad everyday phrases such as 'search', 'find', 'latest', and 'today news', which are likely to activate unintentionally during normal conversation. In an agent environment, accidental activation can cause unrequested external web requests, third-party data disclosure, and workflow hijacking away from safer built-in behavior.

Vague Triggers

High
Confidence
98% confidence
Finding
The trigger list includes extremely broad everyday phrases such as 'search', 'find', and 'latest', which can cause the skill to activate in many unrelated user conversations. In an agent ecosystem, unintended activation can redirect user requests through this skill, causing unauthorized web queries, surprising behavior, and possible data disclosure through externally issued searches.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The natural-language content throughout the file is Chinese-only, including headings, instructions, examples, and operational guidance. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a locale-policy violation.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document describes multiple feedback collection channels, including direct messages, forms, email, and post-search ratings, without any notice about what user data is collected, how it is stored, who can access it, or whether search queries may be linked to identities. In a search skill, feedback can easily include sensitive queries or behavioral data, so omission of privacy handling creates a real data-governance and user-consent risk even if no explicit exfiltration mechanism is shown here.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The document explicitly describes collecting user feedback, usage statistics, behavior analytics, logs, and direct-message feedback, but it does not mention notice, consent, retention, minimization, or access controls. In a search-related skill, this can expose sensitive search queries and user communications, creating privacy and compliance risk even if the file is only operational documentation.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The issue feedback form asks for search queries, timestamps, screenshots, recordings, and free-text descriptions without any privacy notice, minimization guidance, or handling instructions. Those fields can easily capture sensitive personal data, credentials, health/financial searches, or proprietary information, creating privacy and data protection risk if collected or stored improperly.

External Transmission

Medium
Category
Data Exfiltration
Content
# monitor.sh - 性能监控告警

# 检查响应时间
response_time=$(curl -o /dev/null -s -w "%{time_total}\n" "https://api.example.com/search?q=test")

if (( $(echo "$response_time > 5" | bc -l) )); then
    echo "⚠️ 警告:响应时间超过 5 秒 ($response_time s)"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This markdown file contains user-facing skill release and usage guidance entirely in Chinese, including headings, instructions, and examples, but it does not state that the skill is region-specific or provide an opt-in language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
该文件的标题、说明、操作步骤和示例均完全使用中文呈现,且未说明这是面向特定中文用户群体的区域性文档,也未提供其他语言选项。根据语言/区域政策,若技能或相关说明强制单一语言而没有用户选择或明确合理性,属于自然语言策略违规。

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The manifest says the skill uses Baidu for China and Google for international search as primary engines, but this document states newly added primary-capability engines such as Toutiao, 360 News, Brave Search, and DuckDuckGo News. It further frames the skill as simultaneously searching three engines, which materially broadens and changes the described engine behavior rather than merely implementing the stated Baidu/Google-centric design.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document describes AI-generated summaries built from aggregated search result titles and snippets without disclosing whether that content is sent to an external model or service. This creates a privacy and data-governance risk because user queries and retrieved third-party content may be transmitted off-platform without user awareness, potentially violating expectations, policy, or licensing terms.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The manifest advertises v3.1 with features like Baidu/Google primary engines, real-time news, ad filtering, content detoxication, and multi-engine aggregation. But this report is for version 1.0.0 and its own roadmap says Google support and result aggregation are future work, with no evidence here of ad filtering, detoxication, or real-time news functionality. This creates a direct intent/documentation divergence around the skill's claimed capabilities.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The skill manifest says the skill uses Baidu for China and Google for international search as its primary engines. This report instead documents CN Search/360/Sogou/Bing Chinese for domestic queries and DuckDuckGo/Qwant/Startpage/Bing English for international queries, with Google only listed as a future plan. That is an active contradiction between the skill's stated intent and its documentation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The report describes executing searches and scraping result pages through third-party search engines without clearly warning users that their queries will be transmitted externally. This creates a privacy risk because user prompts may contain sensitive data, and routing them to external services can expose intent, identifiers, or confidential terms to third parties and their logs.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
This markdown file is written entirely in Chinese and all example invocations and usage guidance are primarily framed around Chinese-language interaction, but it does not state that the skill is region-specific or offer an explicit user opt-in for language/locale. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The changelog and summary state that v3.0 adds '百度/谷歌搜索' and later describe '百度 + 谷歌' accuracy gains, but the concrete engine inventory for international search lists Startpage, Brave, Qwant, Bing, and DDG variants rather than Google itself. This is an active documentation contradiction about what the skill actually uses, not just an omitted detail.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
The README states the skill automatically chooses the optimal search engine, but the documented selection rules and engine list show DuckDuckGo/360/Sogou/Bing rather than the manifest’s Baidu/Google primary engines. Because the documentation presents a specific selection policy that conflicts with the skill’s declared intent, this is an intent-documentation divergence.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
Automatic language-based routing sends queries to different external providers without explicit user choice, which can affect privacy, jurisdiction, censorship exposure, and result integrity. In this skill’s context, the danger is higher because routing may send Chinese-language or domestic-topic searches to region-specific engines with materially different data-handling practices.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are broad enough to match ordinary conversation such as 'find XXX' or 'latest news,' which increases the chance the skill activates unexpectedly. In a search skill, accidental activation can silently send user-provided text to external websites, creating privacy leakage and reducing user control over tool use.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest describes the skill as using Baidu for China and Google for international search as primary engines, but the README documents actual engine selection as 360/Sogou/Bing Chinese for Chinese queries and DuckDuckGo/Qwant/Startpage/Bing for international queries. This is a substantive mismatch in the skill’s stated core behavior, not a minor implementation detail.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README emphasizes privacy-friendly behavior but does not clearly disclose that user queries are transmitted to third-party search engines such as 360, Sogou, Bing, DuckDuckGo, Qwant, or Startpage. That omission is dangerous because users may enter sensitive terms under the mistaken belief that the skill keeps processing local or private.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
95% confidence
Finding
Using 'search' as a trigger conflicts with a common built-in command and creates command shadowing risk. In practice, this can divert ordinary user requests into this skill's custom behavior, causing unintended external requests and bypassing expected platform-native search safeguards or UX cues.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
94% confidence
Finding
Using 'find' as a trigger similarly collides with a generic built-in intent and raises shadowing risk. Because 'find' is widely used for local lookup, file search, and general assistant tasks, this skill may activate unexpectedly and send the user's request to external websites rather than the intended internal tool or command path.

Static analysis

No suspicious patterns detected.