ClawHub
Back to skill

Security audit

serpshot

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Serpshot web and image search helper, with expected third-party query transmission and no hidden persistence or destructive behavior.

Install only if you intend to use Serpshot as an external search provider. Do not send secrets, private internal URLs, confidential research topics, or personal data as search queries unless you are comfortable sharing them with Serpshot under your API key.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill does not clearly warn that user search terms are sent to Serpshot, a third-party service, along with authentication headers. This omission can lead to inadvertent disclosure of sensitive prompts, research topics, or personal data when the user only asked for generic lookup help.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger phrases are broad enough to activate on many ordinary requests such as 'find', 'lookup', or 'research', increasing the chance the skill is invoked when the user did not intend to send data to this external search provider. In this skill's context, overbroad routing is more dangerous because it causes user prompts and queries to be transmitted off-platform to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
if not api_key:
    raise ValueError("SERPSHOT_API_KEY is not set. Get your key at https://serpshot.com/dashboard")

response = requests.post(
    "https://api.serpshot.com/api/search/google",
    headers={"X-API-Key": api_key, "Content-Type": "application/json"},
    json={
Confidence
94% confidence
Finding
This duplicate finding points to the same outbound POST request, which crosses a trust boundary by sending query content and an API credential to Serpshot. The main danger is unintended disclosure of user-entered data through a capability that may be invoked automatically by broad triggers.

External Transmission

Medium
Category
Data Exfiltration
Content
if not api_key:
    raise ValueError("SERPSHOT_API_KEY is not set. Get your key at https://serpshot.com/dashboard")

response = requests.post(
    "https://api.serpshot.com/api/search/google",
    headers={"X-API-Key": api_key, "Content-Type": "application/json"},
    json={
Confidence
94% confidence
Finding
This duplicate finding points to the same outbound POST request, which crosses a trust boundary by sending query content and an API credential to Serpshot. The main danger is unintended disclosure of user-entered data through a capability that may be invoked automatically by broad triggers.

External Transmission

Medium
Category
Data Exfiltration
Content
raise ValueError("SERPSHOT_API_KEY is not set. Get your key at https://serpshot.com/dashboard")

response = requests.post(
    "https://api.serpshot.com/api/search/google",
    headers={"X-API-Key": api_key, "Content-Type": "application/json"},
    json={
        "queries": ["your search query here"],
Confidence
90% confidence
Finding
The hardcoded remote API endpoint confirms that this skill relies on third-party network access for operation. By itself this is not malicious, but in a skill framework it is a data egress point that can expose user queries and usage patterns outside the host environment.

External Transmission

Medium
Category
Data Exfiltration
Content
api_key = os.environ.get("SERPSHOT_API_KEY")

response = requests.post(
    "https://api.serpshot.com/api/search/google",
    headers={"X-API-Key": api_key, "Content-Type": "application/json"},
    json={
Confidence
94% confidence
Finding
This duplicate line-83 finding reflects the same image-search transmission path to Serpshot. In context, it is more concerning because the skill encourages use for broad 'find' and 'research' requests, which can cause accidental external sharing.

External Transmission

Medium
Category
Data Exfiltration
Content
api_key = os.environ.get("SERPSHOT_API_KEY")

response = requests.post(
    "https://api.serpshot.com/api/search/google",
    headers={"X-API-Key": api_key, "Content-Type": "application/json"},
    json={
Confidence
94% confidence
Finding
This duplicate line-83 finding reflects the same image-search transmission path to Serpshot. In context, it is more concerning because the skill encourages use for broad 'find' and 'research' requests, which can cause accidental external sharing.

External Transmission

Medium
Category
Data Exfiltration
Content
api_key = os.environ.get("SERPSHOT_API_KEY")

response = requests.post(
    "https://api.serpshot.com/api/search/google",
    headers={"X-API-Key": api_key, "Content-Type": "application/json"},
    json={
        "queries": ["your image query here"],
Confidence
90% confidence
Finding
This endpoint usage in the image-search example is another explicit egress path to the same external service. The danger comes not from the URL itself but from the fact that user-supplied content will be sent there, potentially without adequate user awareness.

External Transmission

Medium
Category
Data Exfiltration
Content
## Notes

- Each search query uses 1 credit
- Check remaining credits: `GET https://api.serpshot.com/api/credit/available-credits`
- Full API docs: https://serpshot.com/docs
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.