Security audit
Security checks for vulnerabilities and agentic risk
This skill provides web search and page reading, but its installer and page-fetching behavior are too broadly scoped for low-friction automatic installation.
Install only after reviewing or pinning the source, preferably from a versioned release with hashes. Avoid the one-line curl-to-bash path, do not use the content fetcher on internal or sensitive URLs, and treat search queries and fetched URLs as data shared with external services/sites.
README.md:18Mutable Remote Installer Is Executed Directly Through curl-to-shell
install.sh:7Installer Downloads and Activates Mutable Skill Files Without Integrity Verification
content.js:38Unrestricted Page Fetching Exposes a Server-Side Request Forgery Primitive
install.sh:9Installer Omits the Lockfile and Falls Back to Mutable Dependency Resolution
Using '| bash' enables shell-command chaining from untrusted remote content, so any malicious change to install.sh is executed directly in the user's environment. In a skill ecosystem, this is especially dangerous because users may install quickly from README instructions and grant the script access to local files, tokens, and agent configuration.
curl -fsSL https://raw.githubusercontent.com/interskh/querit-search/main/install.sh | bash
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
### Option C: .env file
Create `~/.openclaw/.env`:
The skill is presented as a search tool returning titles, URLs, and snippets, yet it also supports --content extraction from result URLs and a separate content.js fetch path. This materially expands the trust boundary from search-query brokering to arbitrary remote content retrieval and script-to-script execution, which can expose users to unexpected data transfer and content-handling risks.
The skill is presented as a search tool returning titles, URLs, and snippets, yet it also supports --content extraction from result URLs and a separate content.js fetch path. This materially expands the trust boundary from search-query brokering to arbitrary remote content retrieval and script-to-script execution, which can expose users to unexpected data transfer and content-handling risks.
The skill is presented as a search tool returning titles, URLs, and snippets, yet it also supports --content extraction from result URLs and a separate content.js fetch path. This materially expands the trust boundary from search-query brokering to arbitrary remote content retrieval and script-to-script execution, which can expose users to unexpected data transfer and content-handling risks.
The implementation materially differs from the declared skill purpose: instead of using the Querit.ai API for search results, it performs arbitrary URL fetching and full-page extraction. In an agent environment, this expands capability from search to unrestricted remote content retrieval, which can enable SSRF-like access to internal endpoints, policy bypass, and exfiltration of sensitive page contents the manifest did not disclose.
The | bash pattern is especially risky because it removes any opportunity for inspection and causes immediate execution of whatever content is returned by the remote server. In this skill context, the same installer later performs additional remote downloads and npm installation, so a compromise at any point in the supply chain could lead to arbitrary code execution on the user's machine.
set -euo pipefail
# Querit Search — OpenClaw Skill Installer
# Usage: curl -fsSL https://raw.githubusercontent.com/interskh/querit-search/main/install.sh | bash
SKILL_DIR="${HOME}/.openclaw/skills/querit-search"
REPO_BASE="https://raw.githubusercontent.com/interskh/querit-search/main"
The lockfile pins ws to 8.19.0, and the provided finding states this version is affected by a memory disclosure issue and a memory-exhaustion denial-of-service issue. Even though this skill is primarily a web search utility, jsdom brings in ws transitively; if any code path uses WebSocket functionality or parses attacker-controlled traffic through the vulnerable library, a remote attacker could trigger service instability or expose process memory.
The README advertises web search and content extraction but does not clearly warn that user queries and fetched URLs are sent to external services and remote websites. This creates a privacy and data-handling risk because users or downstream agents may unknowingly exfiltrate sensitive text, targets, or browsing intent outside the local environment.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Create ~/.openclaw/.env:
QUERIT_API_KEY=your-key-here
The README says OpenClaw will use the skill automatically whenever it 'needs to search the web' without defining clear boundaries or requiring explicit user confirmation. In an agent setting, this can cause overly broad automatic transmission of prompts or derived queries to an external service, increasing the chance of unintended data disclosure.
The skill advertises shell, network, and environment-variable use via metadata/install steps, but it does not explicitly declare a restrictive tool scope such as permissions or allowed-tools. That makes the operational boundary unclear and can lead to broader-than-expected execution authority for a skill that handles user-supplied queries and URLs.
The documentation does not warn that user queries and requested URLs or extracted content are sent to an external third-party service. This is dangerous because users may unknowingly transmit sensitive prompts, internal URLs, or proprietary research targets off-platform, creating privacy, confidentiality, and compliance risk.
The file header explicitly describes a content extractor, contradicting the manifest's description of a Querit.ai search skill. This discrepancy is a security-relevant transparency failure: operators and downstream agents may grant permissions or trust assumptions appropriate for search, while the code actually performs broader network retrieval and content extraction.
The code accepts an arbitrary URL and downloads and converts the full HTML body to markdown, which is substantially more powerful than a search-only tool. In agent deployments this can be abused to retrieve sensitive intranet/cloud-metadata pages or hidden web content and return it verbatim, making the mismatch especially dangerous because callers may trust the tool as a benign search interface.
The installer downloads multiple files from a remote GitHub repository and immediately installs Node.js dependencies, which executes code and lifecycle scripts from a package manifest the user has not reviewed. Even though this is normal installer behavior, the script provides no in-file warning about the trust implications, so users are encouraged to run untrusted remote code with little friction.
The package metadata and skill description claim the skill only performs web search, but the declared dependencies support HTML fetching, DOM parsing, readability extraction, and markdown conversion. That capability mismatch is security-relevant because it expands the effective trust boundary and may enable retrieval and transformation of full webpage contents beyond what users or reviewers expect.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Querit Search CLI — queries the Querit.ai search API
// No external dependencies; uses Node.js built-in fetch (18+)
const API_URL = "https://api.querit.ai/v1/search";
const MAX_QUERY_LENGTH = 72;
const DEFAULT_COUNT = 5;
The skill description promises structured search results, but the implementation also supports fetching and extracting full page content from arbitrary result URLs via the --content flag. This expands the skill's effective data access beyond its declared purpose, increasing the chance that users or orchestrators authorize a search-only tool that can actually retrieve and expose substantially more remote content.
The code launches a subprocess to execute content.js for each result URL, introducing an additional capability and trust boundary not implied by the manifest's search-only scope. Even though execFile avoids shell injection, spawning a helper to fetch/process arbitrary remote pages increases attack surface and can enable unintended content access or risky downstream behavior hidden from the declared interface.
The one-line installer pipes a remote script directly into bash, which executes whatever is served at that URL at install time without prior inspection or integrity verification. If the repository, branch, hosting path, or network path is compromised, users can be exposed to immediate arbitrary code execution.
curl -fsSL https://raw.githubusercontent.com/interskh/querit-search/main/install.sh | bash
The examples present English as the default language and explicitly use --lang english, while supported languages are listed later, but the documentation does not state that language choice is user-controlled or optional. This can be read as a locale preference baked into the skill behavior without explicit user opt-in.
The documented installation method uses curl to fetch a remote script from GitHub, which normalizes executing code directly from the network without prior inspection. If the repository, branch, or delivery path is compromised, users may run attacker-controlled code immediately.
set -euo pipefail
# Querit Search — OpenClaw Skill Installer
# Usage: curl -fsSL https://raw.githubusercontent.com/interskh/querit-search/main/install.sh | bash
SKILL_DIR="${HOME}/.openclaw/skills/querit-search"
REPO_BASE="https://raw.githubusercontent.com/interskh/querit-search/main"
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"description": "Web search via Querit.ai API for OpenClaw",
"license": "MIT",
"dependencies": {
"@mozilla/readability": "^0.6.0",
"jsdom": "^27.0.1",
"turndown": "^7.2.2",
"turndown-plugin-gfm": "^1.0.2"
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"license": "MIT",
"dependencies": {
"@mozilla/readability": "^0.6.0",
"jsdom": "^27.0.1",
"turndown": "^7.2.2",
"turndown-plugin-gfm": "^1.0.2"
}
No suspicious patterns detected.