ClawHub
Back to skill

Security audit

免费工具·平替雷达

Security checks for vulnerabilities and agentic risk

Overview

This software-research skill needs review because routine searches can run downloaded code, Windows queries can reach a command shell unsafely, and every result must include advertising.

Review before installing. Prefer a version that requires approval for fixed-version CLI dependencies, fixes Windows command handling, and makes promotions optional. Default searches and even --check can execute npm tools with your account's access. Use public search terms, limit enabled channels and available credentials, and account for the proxy bypass and local Xiaping credential fallback. The evidence supports Review, rather than the pre-scan malicious signal.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (13)

Tainted flow: 'opener' from os.environ.get (line 86, credential/environment) → urllib.request.build_opener.open (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/alt_search.py (reported line 88)May include surrounding context.

python
try:
            opener = urllib.request.build_opener(
                urllib.request.ProxyHandler({"http": REAL_PROXY, "https": REAL_PROXY}))
            with opener.open(req, timeout=TIMEOUT_PROXY) as r:
                return r.read()
        except urllib.error.HTTPError as e:
            if "rate limit" in (e.reason or "").lower():

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/alt_search.py (reported line 132)May include surrounding context.

python
def _run(cmd, env_extra=None, timeout=TIMEOUT_CLI, no_proxy=False):
    """no_proxy=True 时剥离所有代理环境变量(gh/npx 直连 registry/github 更稳)。"""
    env = {**os.environ, **(env_extra or {})}
    if no_proxy:
        for k in PROXY_KEYS:
            env.pop(k, None)

The input-driven external research workflow lacks a privacy warning about sharing search terms with third-party services.

Medium
Category
Output Handling
Confidence
86% confidence
Finding

The skill describes using a supplied software URL, name, or screenshot to drive searches across multiple external services. Although those services are named, the README does not warn that input-derived search terms can disclose private software names or internal project details to third parties.

Content

No source excerpt is available for this finding.

The skill mandates unrelated promotional content in every result, despite its stated software-alternative research purpose.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The skill explicitly requires advertising and an external community link at the end of every output, regardless of the user's research request. This is deliberate response hijacking for the author's benefit, potentially making unsolicited marketing appear endorsed by the assistant; the supplied content does not establish that the destination steals data or hosts malware.

Content

No source excerpt is available for this finding.

The skill requires unsolicited promotional content in every output, redirecting task responses toward the author's marketing channels.

Medium
Category
Prompt Injection
Confidence
99% confidence
Finding

The mandatory footer redirects otherwise legitimate software-research responses toward the author's promotional channels without user consent. Its application to every output makes the deviation persistent rather than incidental; this duplicates the response-hijacking issue identified by SDI-2, not a separate exploit.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

On Windows, this helper enables shell=True for .cmd/.bat launchers, including the commonly used npx.cmd. Search keywords are passed into those commands without Windows shell-safe handling, so attacker-controlled keywords containing shell metacharacters can potentially execute additional commands; passing a Python argument list does not reliably prevent cmd.exe injection.

Content

Scanner excerpt · scripts/alt_search.py (reported line 137)May include surrounding context.

python
for k in PROXY_KEYS:
            env.pop(k, None)
        env["no_proxy"] = "*"
    p = subprocess.run(
        cmd, capture_output=True, text=True, encoding="utf-8", errors="replace",
        timeout=timeout, env=env, shell=(os.name == "nt") and cmd[0].endswith((".cmd", ".bat")),
    )

Tainted flow: 'env' from os.environ (line 132, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/alt_search.py (reported line 137)May include surrounding context.

python
for k in PROXY_KEYS:
            env.pop(k, None)
        env["no_proxy"] = "*"
    p = subprocess.run(
        cmd, capture_output=True, text=True, encoding="utf-8", errors="replace",
        timeout=timeout, env=env, shell=(os.name == "nt") and cmd[0].endswith((".cmd", ".bat")),
    )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alt_search.py (reported line 190)May include surrounding context.

python
out = _run([gh, "api", f"repos/{repo}/readme", "--jq", ".content"], timeout=90, no_proxy=True)
        if out.strip():
            return base64.b64decode(out.strip()).decode("utf-8", "replace")
    return _get_text(f"https://api.github.com/repos/{repo}/readme",
                     no_proxy=True, headers={"Accept": "application/vnd.github.raw+json"})

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alt_search.py (reported line 386)May include surrounding context.

python
timeout=60, no_proxy=True)
            names = [n.strip() for n in out.splitlines() if n.strip()]
        else:
            data = _get_json("https://api.github.com/repos/anthropics/skills/contents/skills", no_proxy=True)
            names = [d["name"] for d in data]
        kws = [w.lower() for w in re.split(r"[,\s]+", q) if w]
        items = [_item(n, "Anthropic 官方技能", 0, f"https://github.com/anthropics/skills/tree/main/skills/{n}",

Search channels can automatically download and execute npm packages without warning or confirmation.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The search channels invoke npx --yes with unpinned clawhub and skills packages, allowing npm to download and execute third-party code without confirmation. These channels run by default and during channel checks, so an apparently read-only search can execute a compromised dependency with the user's filesystem access and inherited credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alt_search.py (reported line 342)May include surrounding context.

python
items = [_item(d["fullName"], d.get("description"), d.get("stargazersCount"),
                           f"https://github.com/{d['fullName']}", "github", "oss") for d in data]
        else:
            url = ("https://api.github.com/search/repositories"
                   + urllib.parse.urlencode({"q": q, "sort": "stars", "per_page": 25}))
            data = _get_json(url, no_proxy=True)
            items = [_item(d["full_name"], d.get("description"), d.get("stargazers_count"),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alt_search.py (reported line 516)May include surrounding context.

python
last_err = e
    # 第三级: PullPush Reddit 数据镜像(不受本机封锁影响; 数据截至 2023 年中, 仅作补充)
    try:
        data = _get_json("https://api.pullpush.io/reddit/search/submission/"
                         + urllib.parse.urlencode({"q": q, "size": 10}))
        items = []
        for d in (data.get("data") or [])[:10]:

The skill requires Chinese and English keyword output without offering a language choice.

Low
Category
Output Handling
Confidence
94% confidence
Finding

The keyword-table instructions require at least three groups each in Chinese and English, regardless of the user's preferred language. This is an explicit output-language constraint with no user opt-in or documented locale-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.