Security audit

Query-Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent OpenClaw skill search tool, but it silently forwards searches to an undisclosed mirror and can overstate trust in mirror results.

Review before installing if your searches may contain private project names, customer data, vulnerability details, or internal technology names. The tool may send those terms to both ClawHub and an undisclosed mirror, and mirror results may be shown as verified even though the artifact does not verify them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

other

Warning

Location: src/clawhub-api.js:41
Finding: Undisclosed Forwarding of Search Queries to a Third-Party Mirror
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/clawhub-api.js:69
Finding: Untrusted Mirror Results Are Incorrectly Marked as Verified
Content: View full analysis
{ // Extract information from metaContent const metaContent = item.metaContent || {}; const skillMd = metaContent.skillMd || ''; // Parse information from skillMd const nameMatch = skillMd.match(/name: (.*)/); const descriptionMatch = skillMd.match(/description: (.*)/); return Skill.fromJSON({ name: metaContent.displayName || item.displayName || nameMatch?.[1] || item.slug, slug: item.slug, description: metaContent.DisplayDescription || descriptionMatch?.[1] || item.summary || 'No description', tags: metaContent.Keywords || [], downloads: 0, verified: true, qualityScore: item.score || 0, repository: '', installCommand: '', version: item.version || '1.0.0', author: metaContent.owner || 'Unknown author', createdAt: new Date(item.updatedAt || Date.now()).toISOString(), updatedAt: new Date(item.updatedAt || Date.now()).toISOString() }); }); ``` ### Technical Analysis Every record returned by the third-party mirror is assigned `verified: true` without verifying its origin, signature, ownership, moderation status, or content integrity. The response is also accepted without a strict schema or field validation. The `verified` value is subsequently displayed to users as a trust indicator. This creates a false security signal: data supplied by a compromised service, malicious upstream publisher, or manipulated response can be represented as verified even though no verification process occurred. ### Attack Path 1. An attacker publishes a malicious or misleading skill record accepted by the mirror, ...[truncated 828 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/ui-helper.js:37
Finding: Terminal Escape Injection Through Untrusted Skill Metadata
Content: View full analysis
{ console.log(`\n${index + 1}. ${skill.name}`); console.log(` Source: ${skill.source}`); console.log(` Description: ${skill.description}`); console.log(` Tags: ${skill.tags?.join(', ') || 'None'}`); console.log(` Downloads: ${skill.downloads || 0}`); console.log(` Quality score: ${skill.qualityScore || 0}`); console.log(` Verified: ${skill.verified ? 'Yes' : 'No'}`); if (skill.installCommand) { console.log(` Installation command: ${skill.installCommand}`); } if (skill.sourceUrl) { console.log(` Source URL: ${skill.sourceUrl}`); } }); ``` The same unsafe output pattern also appears in `showSkillDetails()` and `showRecommendations()`. ### Technical Analysis Skill names, descriptions, tags, installation commands, and URLs originate from remote API responses but are written directly to the terminal without removing control characters or ANSI/OSC escape sequences. A malicious metadata value can contain terminal instructions rather than ordinary text. Depending on terminal capabilities and configuration, these sequences can: - Clear or rewrite previously displayed output. - Forge warnings, verification labels, or command prompts. - Create deceptive hyperlinks. - Change terminal titles or visual attributes. - Attempt clipboard modification through supported OSC sequences. This is a terminal-output injection issue, not shell command injection: the application does not pass these values to a shell. Exploitation depends on the victim's terminal emulator interpreting the supplied sequences. ### Attack Path 1. A ...[truncated 1027 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file contains user-visible status and error messages exclusively in Chinese, such as comments and especially console/error strings later used for operational messaging. This imposes a specific language choice without any opt-in or locale selection mechanism, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: When the primary search returns no results or errors, the code automatically sends the user's query to a different external domain (skills.volces.com) without explicit user awareness or consent. Search queries may contain sensitive or proprietary terms, so this fallback expands data exposure to an undisclosed third party and changes the trust boundary unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code consistently forces Chinese-language user-facing messages and developer-facing guidance, such as the returned error messages and log labels. The policy requires flagging language or locale constraints when the skill does not provide user opt-in or a documented justification for the fixed language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The language detection returns only 'zh' when Chinese characters are present and defaults every other input to 'en'. This imposes a binary language policy on all users and excludes other locales without any documented opt-in or justification, which is a natural-language locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI's user-facing strings are consistently in Chinese, including help/error/result labels, with no indication that the tool is intended only for Chinese-speaking users and no option to select another language. This creates a natural-language locale policy concern because the skill imposes a specific language on all users without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code logs both the original user query and the translated query directly to the console, which can expose sensitive search terms, personal data, or proprietary intent to logs that may be retained, aggregated, or viewed by operators. Because search input is fully user-controlled and translation may reveal normalized meaning, this creates a real privacy and data-handling risk even if no external attacker is involved.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: When the detected language is 'zh', the code boosts results containing Chinese characters in the skill name or description. This imposes a locale-specific ranking preference automatically, and the file does not indicate any user choice or opt-in for this language-biased behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code embeds user-visible natural-language strings entirely in Chinese, including the source description and error messages. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains user-facing comments and console messages entirely in Chinese, including status messages and command help. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description states the skill 'supports Chinese and English bilingual' behavior, which is a natural-language locale/language constraint. Because the text does not indicate that users can choose their preferred language or opt in to that behavior, it may conflict with the policy against forcing a specific language/locale without user choice.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: The dependency uses a caret range (^1.6.8), which permits automatic installation of newer minor/patch releases. This weakens supply-chain reproducibility and can unexpectedly introduce vulnerable or malicious code if an upstream release is compromised or contains a regression.
Content: Scanner excerpt · package.json (reported line 21)May include surrounding context.
json
"author": "", "license": "MIT", "dependencies": { "axios": "^1.6.8" }, "devDependencies": {} }

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: The manifest declares axios without an exact version, while the package has multiple known advisories across versions. Because the installed version is not verifiable from this file alone, deployments may resolve to a release affected by issues such as SSRF, proxy bypass, or request-handling flaws depending on environment and lockfile state.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file's natural-language comments are written exclusively in Chinese, which constitutes a language-specific constraint in the skill artifact without any indication of user choice or opt-in. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The file's natural-language comments are consistently written in Chinese, which reflects a fixed language choice in user-facing or maintainer-facing text without any indication of opt-in, alternatives, or region-specific justification. Under the stated policy, forcing a specific language can be a locale/language policy concern when no choice is offered.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The method returns user-facing quality labels only in Chinese ('优秀', '良好', '一般', '较差'). This imposes a specific language in the skill behavior without any visible opt-in, fallback, or documented region-specific justification, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description and error messages at L05, L10, and L15 are user-facing strings written only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is documented or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code includes user-visible natural-language strings such as the source description and console error messages entirely in Chinese. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JavaScript file contains multiple natural-language comments and error/log messages exclusively in Chinese, such as the initialization comments and console error text. Under the stated policy, forcing a specific language without offering a user language choice or documenting a justified locale restriction is a natural-language policy concern.
Content: No source excerpt is available for this finding.