ClawHub
Back to skill

Security audit

Naver Search

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Naver search skill using SerpAPI, with routine API-key and query-privacy cautions but no hidden or harmful behavior found.

Install only if you are comfortable providing a SerpAPI key and sending search terms to SerpAPI/Naver. Avoid secrets, confidential internal terms, or personal data in queries, keep any `.env` file private, and consider pinning the `serpapi` dependency for reproducible installs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README instructs users to configure a SerpAPI key and send Naver search queries through an external service, but it does not disclose that user queries and related metadata will be transmitted to a third party. This can create privacy, compliance, and trust issues, especially if agents submit sensitive prompts, internal terms, or user-derived data without informed consent.

Unpinned Dependencies

Low
Category
Supply Chain
Content
serpapi
Confidence
93% confidence
Finding
The dependency is specified without a version pin, so future installs may resolve to a newer release with breaking changes or a compromised/transitively vulnerable package version. While this file alone does not prove exploitation, unpinned dependencies weaken supply-chain integrity and reduce build reproducibility.

Static analysis

No suspicious patterns detected.