Yves Web Search

• Analyzed: May 12, 2026, 4:26 AM
• Findings: 0
• Version: 1.0.1
• Hash: 456a688f98fe55d43891e2713a15bb9d6cec9e10d28e2f95b4ba803f4aae814c
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: yves-web-search Version: 1.0.1 The `scripts/reader.sh` file contains a URL parameter injection vulnerability. Arguments such as `--proxy`, `--selector`, and `--remove` are not sufficiently sanitized for URL control characters (e.g., '&', '=') before being appended to the `BASE_URL` for the `curl` command. This flaw could allow an attacker to inject arbitrary parameters into the Jina AI API request, potentially altering its intended behavior. There is no evidence of intentional malicious behavior like data exfiltration or backdoors.