ClawHub
Back to skill

Security audit

Search

Security checks for vulnerabilities and agentic risk

Overview

This search skill mostly matches its web-search purpose, but it under-discloses local script execution and hardcoded/shared Tavily credential use.

Review this skill before installing. It can send search queries to third-party services, uses a shared hardcoded Tavily fallback credential, and may execute an external Python script from a fixed Windows path that is not included in the reviewed package. Prefer a version that removes the embedded key, calls Tavily directly through reviewed code, and documents all network and subprocess behavior.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
plugin.ts:92
Finding

Hardcoded Tavily API Credential Exposed in Source Code

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
plugin.ts:94
Finding

Execution of Unreviewed External Python Script with API Credential

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This is a significant description-behavior mismatch: the skill claims to be a simple web search wrapper, but static analysis indicates undisclosed local script execution, hardcoded/default API key handling, inaccurate engine routing, and direct scraping behavior. Undisclosed execution paths and credential use can conceal risky actions, bypass user expectations, and expose secrets or create unauthorized network activity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The search tool invokes a local Python script via subprocess for the Tavily path, which exceeds the minimally necessary capability for a web-search skill. Spawning local executables broadens the attack surface to local code execution, script tampering, and environment abuse, especially because the path is fixed and receives privileged credentials via environment variables.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The 'multi' engine path again launches a local Python script instead of performing a bounded search operation. This gives a nominal search skill unnecessary execution capability and creates risk of arbitrary local code execution or misuse if the script is modified, replaced, or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill advertises web-search functionality but does not declare tool scope despite requiring network and environment access. Missing explicit permissions reduces transparency and reviewability, making it easier for a skill to access sensitive resources or perform outbound requests without informed approval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The automatic engine-selection logic is described and implemented around Chinese-language and China-specific query heuristics, using Chinese-only comments and routing rules for terms like 中国, 国内, 百度, 微信, and 抖音. This creates a locale-specific behavior bias without any user choice or documented opt-in, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This path performs subprocess execution without any user-facing disclosure, even though users would reasonably expect a search tool to make network requests rather than execute local programs. Hidden execution semantics reduce transparency and can mask elevated-risk behavior such as local script execution and secret propagation to child processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code comments and description claim a multi-engine path without an API key, but the implementation actually runs a Tavily script and injects a Tavily API key. This mismatch is dangerous because it conceals credential use and true behavior from reviewers and users, undermining informed consent and making abuse or unexpected billing/data exposure harder to detect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The multi-engine path both accesses a sensitive API key and launches a subprocess without any user-facing warning. This combination is riskier than ordinary hidden implementation detail because it exposes credentials to a child process while presenting the action as a simple search operation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code embeds a fallback Tavily API key directly in source, which exposes a live credential to anyone with repository or package access. Hardcoded secrets are routinely harvested and abused for unauthorized API usage, cost fraud, quota exhaustion, and possible linkage to the project owner's account activity.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · providers/tavily.ts (reported line 12)May include surrounding context.

ts
try {
    // 使用 Tavily API
    const response = await fetch('https://api.tavily.com/search', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · providers/tavily.ts (reported line 12)May include surrounding context.

ts
try {
    // 使用 Tavily API
    const response = await fetch('https://api.tavily.com/search', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code sends the user-provided query to https://api.tavily.com/search, which is a network operation that can transmit user data off-system. Although there is an internal comment and an error log, there is no user-facing prompt, disclosure, or warning in the file explaining that queries are sent to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The tool description is written only in Chinese and instructs use of the tool in that locale, while the manifest does not state that the skill is intended only for Chinese-speaking users or provide any language/locale opt-in. This creates a natural-language locale policy concern because the skill appears to impose a specific language without user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code file contains natural-language comments and API documentation entirely in Chinese, with no indication that the skill is region-specific or that users may choose another language. Under the policy rule for language/locale constraints, this can be a documentation-level locale policy violation when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s human-readable description and comments are written only in Chinese, including the skill description and usage notes. This imposes a specific language context without any indication of user opt-in or a documented region-specific requirement, which matches the locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The natural-language comments are written only in Chinese and do not indicate that language selection is optional or intentionally constrained to a Chinese-speaking context. Under the policy, a fixed language can be a locale-choice issue when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code sends the user's search query to a SearXNG endpoint over HTTP by default when SEARXNG_URL is not set, which means queries may be exposed in cleartext to the local network, proxies, or other intermediaries if the service is reached over an unsecured interface. In a search skill, user queries can contain sensitive prompts, making this a real privacy and data-exposure issue even though it is not direct code execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The only human-readable instructional text in this file is written in Chinese, which can create a language/locale constraint for maintainers or users without any opt-in or justification. Under the policy, forcing a specific language without user choice or documented regional need is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
plugin.ts:74

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
providers/searxng.ts:7

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
providers/tavily.ts:8