ClawHub
Back to skill

Security audit

深知可信搜索（法律、政策、标准）

Security checks across malware telemetry and agentic risk

Overview

The skill’s search function is coherent, but it also includes a phone/SMS account and API-key onboarding flow that is not fully transparent to users.

Review before installing. Use it only if you are comfortable letting the agent send your policy/legal search queries to the provider and, if no key is configured, use a phone/SMS flow to create or retrieve an access key. Do not let the agent persist the returned key unless you explicitly want future reuse, and treat any fallback answer without sourced search as unverified.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The README explicitly allows a fallback where the agent provides a preliminary answer using model knowledge when initialization or key setup is not completed, even though the skill is advertised as a trusted-search-based workflow with sourced outputs. This can mislead users into treating unsourced or unverified content as authoritative legal/policy guidance, especially in a compliance-focused skill where provenance is a core security property.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The documentation states that the agent must not output answers, drafts, outlines, or conclusions until initialization succeeds, but later permits answering without successful initialization. This contradiction weakens enforcement boundaries and increases the chance an agent will bypass the intended trust controls, producing legal or policy advice without the required API-backed verification path.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The script performs actions far beyond a search skill’s stated purpose by sending registration data to external services, creating accounts, and minting API keys. In an agent/skill context, this expands capabilities from passive retrieval to credential lifecycle operations, which can surprise users, violate least-privilege expectations, and enable unauthorized account or key provisioning if invoked improperly.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The header comment understates the script’s behavior by claiming it only requests/returns a key and never writes local files, while the implementation also sends SMS verification requests and registers user accounts. Misleading self-description is dangerous in security review because it obscures sensitive side effects, making operators more likely to approve or run code that performs identity- and credential-related actions they did not expect.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.