ClawHub
Back to skill

Security audit

InfoSeek

Security checks for vulnerabilities and agentic risk

Overview

InfoSeek appears to be a legitimate web research archiving skill, but it understates privacy exposure and has a risky Windows deletion helper.

Review before installing. Use it only when you are comfortable sending search subjects, context, URLs, and page requests to external providers, and storing potentially sensitive local archives. Avoid person-focused dossiers unless you have a lawful and appropriate basis, keep archives in a controlled workspace, review dependent search/browser skills separately, and avoid the Windows delete helper until its PowerShell path handling is fixed.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
Add-Type -AssemblyName Microsoft.VisualBasic
        [Microsoft.VisualBasic.FileIO.FileSystem]::DeleteFile("{safe_path}", "OnlyErrorDialogs", "SendToRecycleBin")
        '''
        result = subprocess.run(
            ['powershell', '-Command', ps_command],
            capture_output=True, text=True, timeout=30
        )
Confidence
94% confidence
Finding
The Windows recycle-bin implementation builds a PowerShell script by interpolating the user-controlled filepath into `ps_command` and then passes that script to `powershell -Command`. Replacing double quotes is not sufficient to safely encode arbitrary input for PowerShell, so a crafted filename can break out of the string context or otherwise alter script behavior, leading to command/script injection in the agent's execution context.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions while its documented workflow relies on environment access, filesystem writes, shell execution, and networked search/browser operations. This mismatch weakens the trust boundary for users and policy enforcement, because a caller may approve the skill under the false assumption that it has no meaningful capabilities.

Tp4

High
Category
MCP Tool Poisoning
Confidence
76% confidence
Finding
The description advertises comprehensive search and browser extraction behavior, but the file mainly contains orchestration instructions and references to external skills/tools rather than implementing those functions itself. This is dangerous because users and reviewers may make security decisions based on inaccurate documentation, hiding real dependencies and side effects while obscuring what code is actually responsible for collection and storage.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The privacy section claims no personal data is stored, yet the workflow explicitly supports research on persons and archives article content plus metadata tied to a subject. That contradiction can lead operators to collect and retain personal data without appropriate consent, notice, retention controls, or legal review.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documentation says there is no external data transmission, but the workflow explicitly uses third-party search engines and remote browser fetches. This is dangerous because user queries and browsing targets may be disclosed to external services, creating privacy, compliance, and OPSEC risk under a false assurance of local-only processing.

Static analysis

No suspicious patterns detected.