ClawHub

Kimi Websearch

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Kimi/Moonshot web-search helper, but users should know their search questions are sent to an external API.

Install only if you are comfortable sending search questions to Moonshot/Kimi. Use a dedicated API key where possible, monitor quota or billing, and avoid putting secrets, private documents, or sensitive personal data into search queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The activation conditions are extremely broad: use whenever the user needs online information, whenever the assistant cannot answer directly, or whenever more information might help. This can cause the skill to trigger for many normal requests, unnecessarily sending user queries to an external search provider and increasing privacy exposure, unintended tool use, and overreach.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The tool sends the user's question and system prompt to an external service for processing, but the code does not provide any explicit user-facing notice or consent step at runtime. This creates a privacy and data-handling risk because users may unknowingly transmit sensitive prompts or queries to a third-party provider.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal