ClawHub
Back to skill

Security audit

Felo AI Search

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Felo API search helper; it sends search queries to Felo and uses a user-provided API key, which is expected for its purpose.

Install only if you are comfortable sending search queries to Felo. Prefer FELO_API_KEY from your environment or a secret manager, rotate the key if exposed, and avoid putting passwords, private customer data, internal source, or other confidential content into Felo queries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description says to use the skill for phrases like '幫我查', '搜尋一下', 'research', and 'what's trending'. Several of these are generic requests that commonly appear in normal conversation, which creates ambiguity about when this skill should activate instead of other search or research tools.

Session Persistence

Medium
Category
Rogue Agent
Content
- **Environment variable** (recommended): `export FELO_API_KEY="your-key-here"`
   - **File** (set strict permissions):
     ```bash
     mkdir -p ~/.config/felo
     echo "your-key-here" > ~/.config/felo/api_key
     chmod 600 ~/.config/felo/api_key
     ```
Confidence
89% confidence
Finding
The skill instructs users to persist an API key in ~/.config/felo/api_key, which creates a long-lived local secret on disk. Even with mode 600, persisted plaintext credentials increase the blast radius if the account or filesystem is later compromised, and the example shell command may also leave traces in shell history if adapted incautiously.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
     mkdir -p ~/.config/felo
     echo "your-key-here" > ~/.config/felo/api_key
     chmod 600 ~/.config/felo/api_key
     ```

## Basic Usage
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
## Basic Usage

```bash
curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer ${FELO_API_KEY:-$(cat ~/.config/felo/api_key 2>/dev/null)}" \
  -H "Content-Type: application/json" \
  -d '{"query": "Your search query here (1-2000 chars)"}' | jq .
Confidence
96% confidence
Finding
This skill explicitly sends user-provided queries and an API credential to a third-party service over the network. That is expected for a web search integration, but it is still a real external transmission risk because sensitive prompts, internal data, or secrets pasted by a user could be disclosed to Felo.

External Transmission

Medium
Category
Data Exfiltration
Content
### Community Scanning

```bash
curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer ${FELO_API_KEY:-$(cat ~/.config/felo/api_key 2>/dev/null)}" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
96% confidence
Finding
The community-scanning example again transmits prompt contents to an external API, creating the same confidentiality boundary issue. In context this is the tool's intended behavior, but it remains a true risk if agents forward sensitive user or system context into the query.

Static analysis

No suspicious patterns detected.