ClawHub
Back to skill

Security audit

Xyz

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed web-search skill that sends search queries to configured search providers, with documentation inconsistencies but no evidence of hidden exfiltration, persistence, or destructive behavior.

Install only if you are comfortable with user search terms leaving the local environment for the selected search provider. Avoid putting secrets, private project names, customer data, or regulated information into queries. Expect some documentation rough edges: use scripts/web_search.py rather than the documented scripts/xyz.py unless the package is corrected.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tainted flow: 'req' from os.environ.get (line 104, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/web_search.py (reported line 105)May include surrounding context.

python
for url in NETWORK_TEST_URLS:
        try:
            req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                if resp.status == 200:
                    return True
        except Exception:

Tainted flow: 'req' from os.environ.get (line 104, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/web_search.py (reported line 123)May include surrounding context.

python
for url in NETWORK_TEST_URLS:
        try:
            req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                if resp.status == 200:
                    return True
        except Exception:

Tainted flow: 'req' from os.environ.get (line 104, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/web_search.py (reported line 141)May include surrounding context.

python
for url in NETWORK_TEST_URLS:
        try:
            req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                if resp.status == 200:
                    return True
        except Exception:

Tainted flow: 'req' from os.environ.get (line 104, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/web_search.py (reported line 189)May include surrounding context.

python
"Accept": "text/html",
    })

    with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp:
        page = resp.read().decode("utf-8", errors="replace")

    results = []

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill describes capabilities involving environment variables and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, this can cause over-broad execution authority, make review harder, and increase the chance that the skill is invoked with more access than intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is introduced as a straightforward web-search utility, but later claims autonomous multi-round research, LLM analysis, deep reasoning, and report generation. This capability mismatch is dangerous because users and policy systems may approve a low-risk search tool while the skill actually performs broader data processing and external-service interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation description is broad enough to overlap with many ordinary user requests for information, resources, or current events. In an agent environment, overly general trigger criteria can cause unnecessary network access, unreviewed data sharing, or accidental use of this skill when a safer local response would suffice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document first instructs users to run a concrete script and details CLI arguments, then later claims the skill contains no executable script. This inconsistency can mislead operators and agents about what will actually execute, undermining security review and enabling unsafe assumptions about runtime behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill states that it performs network searches and connectivity checks, but it does not clearly warn that user queries may be transmitted to third-party services. This creates a privacy and data-governance risk, especially if users provide sensitive, proprietary, or regulated information in search terms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script transmits user search queries to third-party services such as DuckDuckGo, Tavily, Bing, Google, or a configured SearXNG instance without any explicit user-facing privacy warning or consent gate at execution time. In an agent setting, users may provide sensitive prompts or internal terms assuming local processing, so silent outbound disclosure increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This code sends user queries and an API key to an external service at api.tavily.com, which is an intentional external transmission but still security-relevant because it can disclose sensitive user input and operational metadata to a third party. In an agent skill, this risk is heightened because upstream prompts may contain secrets, internal project names, or regulated data unless explicitly filtered.

Content

Scanner excerpt · scripts/web_search.py (reported line 235)May include surrounding context.

python
"include_answer": False,
    }

    data = http_post_json("https://api.tavily.com/search", payload)

    results = []
    for r in data.get("results", []):

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Bing request hardcodes mkt=zh-CN, which imposes a specific locale on results regardless of user preference. This is a natural-language/locale policy concern because the file does not offer opt-in, configurability, or justification for restricting searches to Chinese-market results.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This code sends search queries to Bing's external API, which exposes user-provided content to a third-party provider. While intended for functionality, it becomes a real privacy/security concern in an agent environment where prompts may include confidential data that should not leave the trust boundary.

Content

Scanner excerpt · scripts/web_search.py (reported line 255)May include surrounding context.

python
encoded_query = urllib.parse.quote_plus(query)
    url = (
        f"https://api.bing.microsoft.com/v7.0/search"
        f"?q={encoded_query}&count={max_results}&mkt=zh-CN"
    )

Static analysis

No suspicious patterns detected.