ClawHub
Back to skill

Security audit

BigModel Web Search Fallback

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent BigModel/Zhipu web-search wrapper, with expected network and API-key use but clearer privacy disclosure would help.

Install only if you are comfortable sending search queries, and optionally request_id or user_id values, to BigModel/Zhipu. Avoid using it with secrets, personal data, or confidential internal content unless that provider use is approved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs use of a local wrapper that depends on environment variables and performs outbound calls to an external search API, but the skill metadata does not declare tool scope such as permissions or allowed tools. This weakens policy enforcement and user/operator visibility, making it easier for the skill to access secrets and the network without explicit approval boundaries.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill description and guidance direct the agent to send user queries to Zhipu/BigModel web-search and chat-completions services, but they do not prominently warn that user input is transmitted to a third-party provider. This creates a privacy and data-handling risk because sensitive prompts, internal terms, or regulated data could be exfiltrated externally without informed user consent.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script sends user-provided search queries to a third-party API and, in raw mode, can also include optional user_id and request_id values. Because the CLI interface does not clearly disclose that these values will be transmitted off-system to an external provider, operators may unintentionally send sensitive personal, internal, or regulated data to that service.

Static analysis

No suspicious patterns detected.