ClawHub
Back to skill

Security audit

llm

Security checks for vulnerabilities and agentic risk

Overview

This search skill mostly matches its stated purpose, but its code sends the API key and queries to a different undocumented host and does not enforce some promised search controls.

Review this skill before installing. Use it only if you are comfortable sending search terms, X filters, dates, and the configured API key to the runtime endpoint in the code; avoid secrets or sensitive business, personal, legal, medical, or regulated data in queries. If already used, consider rotating the API key and confirming whether api.heybossai.com is an authorized SkillBoss endpoint.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
search.mjs:38
Finding

API Credential and Search Queries Sent to an Undocumented Endpoint

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
search.mjs:14
Finding

Declared Domain Search Restrictions Are Validated but Silently Ignored

Content
View full analysis
5) { throw new Error('Maximum 5 allowed_domains'); } if (excluded_domains && excluded_domains.length > 5) { throw new Error('Maximum 5 excluded_domains'); } if (allowed_domains && excluded_domains) { throw new Error('Cannot use both allowed_domains and excluded_domains'); } // Make API request via SkillBoss API Hub const response = await fetch('https://api.heybossai.com/v1/pilot', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${process.env.SKILLBOSS_API_KEY}` }, body: JSON.stringify({ type: 'search', inputs: { query }, prefer: 'balanced' }) }); ``` The documented implementation instead modifies the outbound query: ```javascript // SKILL.md:126-139 const { query, allowed_domains, excluded_domains } = options; let enhancedQuery = query; if (allowed_domains?.length > 0) { enhancedQuery += ' site:(' + allowed_domains.join(' OR ') + ')'; } if (excluded_domains?.length > 0) { enhancedQuery += ' ' + excluded_domains.map(d => `-site:${d}`).join(' '); } const result = await pilot({ type: 'search', inputs: { query: enhancedQuery }, prefer: 'balanced' }); ``` ### Technical Analysis `search_web` accepts and validates `allowed_domains` and `excluded_domains`, giving callers the reasonable expectation that these values constrain the ...[truncated 2356 chars]
Remediation
View remediation
`-site:${domain}` ).join(' ')}`; } const requestBody = { type: 'search', inputs: { query: enhancedQuery }, prefer: 'balanced' }; ``` 2. Prefer dedicated provider API fields for domain restrictions if supported, because textual search operators may not provide a strict security boundary. 3. Validate that every domain is a syntactically valid hostname and reject whitespace, search operators, URLs, and other query-control characters. 4. Treat empty arrays consistently so that two empty filter arrays do not trigger a misleading mutual-exclusion error. 5. Add unit tests that inspect the outbound request and confirm that allowed and excluded domains are enforced. 6. Add integration tests confirming returned citations comply with the requested allowlist. If strict enforcement is required, filter and reject noncompliant results after receiving the response. 7. Reject unsupported media-understanding parameters with a clear error, or implement and transmit them as documented, rather than silently ignoring them. 8. Document whether restrictions are advisory search operators or strict policy controls so callers do not rely on guarantees the provider cannot enforce. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The metadata declares an external API base hosted by SkillBoss, indicating the skill depends on transmitting user requests to a remote service. In a search skill this is expected behavior, but it is still security-relevant because user queries and potentially sensitive context are exposed to an outside provider and subject to that provider’s retention, logging, and policy controls.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
homepage: https://github.com/yourusername/xai-grok-search
metadata:
  category: search
  api_base: https://api.skillbossai.com/v1
  capabilities:
    - api
    - web-search

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user-provided queries to a third-party service (SkillBoss API Hub) for processing, but the description and usage guidance do not clearly warn users that their prompts and filters will leave the local environment. This creates a privacy and compliance risk because users may unknowingly transmit sensitive data, credentials, proprietary research topics, or personal information to an external processor.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The implementation performs a POST request to https://api.skillbossai.com/v1/pilot, directly transmitting the constructed search query and any applied domain/handle/date filters to an external service. This is potentially dangerous if upstream agent context or sensitive user input is included in the query, because the data may be logged, retained, or further processed outside the user’s trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

javascript
const API_KEY = process.env.SKILLBOSS_API_KEY
const API_BASE = 'https://api.skillbossai.com/v1'

async function pilot(body) {
  const r = await fetch(`${API_BASE}/pilot`, {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md
## API Documentation

- SkillBoss API Hub: https://api.skillbossai.com/v1/pilot

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest description says the skill provides real-time access, citations, and image understanding. In both search functions, the documented image/video understanding flags are accepted but never sent in the API request, and the returned object hard-codes citations: [], so the implemented behavior does not match the claimed capabilities.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This code performs an outbound HTTPS request to an external service and includes an authorization bearer token plus user query data. External transmission is intrinsic to a search connector, but it is still a true security-relevant behavior because it expands the trust boundary and can leak sensitive inputs to a third party if the skill is used in a high-trust environment.

Content

Scanner excerpt · search.mjs (reported line 38)May include surrounding context.

js
}

  // Make API request via SkillBoss API Hub
  const response = await fetch('https://api.heybossai.com/v1/pilot', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This code performs an outbound HTTPS request to an external service and includes an authorization bearer token plus user query data. External transmission is intrinsic to a search connector, but it is still a true security-relevant behavior because it expands the trust boundary and can leak sensitive inputs to a third party if the skill is used in a high-trust environment.

Content

Scanner excerpt · search.mjs (reported line 38)May include surrounding context.

js
}

  // Make API request via SkillBoss API Hub
  const response = await fetch('https://api.heybossai.com/v1/pilot', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill sends user-provided search queries to a third-party remote API, which creates a real data-exposure risk if users enter sensitive, proprietary, or regulated information. In a search skill this transmission is expected, but the absence of in-code disclosure, consent cues, minimization, or privacy guardrails increases the chance of accidental leakage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The search_x docstring advertises enable_image_understanding and enable_video_understanding, implying those options affect the search behavior. However, the function never incorporates either flag into enrichedQuery or the API body, so the actual code performs plain text search only.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The X search path also sends enriched user queries to the same external API, crossing the local-to-third-party trust boundary. In context this is expected functionality, but it remains security-significant because investigative queries, account filters, and time windows may be sensitive and are exported off-system.

Content

Scanner excerpt · search.mjs (reported line 118)May include surrounding context.

js
if (to_date) enrichedQuery += ` before:${to_date}`;

  // Make API request via SkillBoss API Hub
  const response = await fetch('https://api.heybossai.com/v1/pilot', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The X search path also sends enriched user queries to the same external API, crossing the local-to-third-party trust boundary. In context this is expected functionality, but it remains security-significant because investigative queries, account filters, and time windows may be sensitive and are exported off-system.

Content

Scanner excerpt · search.mjs (reported line 118)May include surrounding context.

js
if (to_date) enrichedQuery += ` before:${to_date}`;

  // Make API request via SkillBoss API Hub
  const response = await fetch('https://api.heybossai.com/v1/pilot', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

X search queries, including handle filters and date constraints, are transmitted to a third-party service. While consistent with the skill's purpose, this still presents a genuine confidentiality concern because user interests, investigations, or sensitive terms may be exposed externally without any explicit warning or consent mechanism in the code.

Content

No source excerpt is available for this finding.