Security audit

Chinese Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Chinese search helper, but it includes under-disclosed third-party query sharing, an unrelated insecure endpoint, and unpinned install commands users should review before installing.

Review the provider list before use and avoid entering secrets, credentials, private customer data, or sensitive project names as search terms. Prefer a pinned ClawHub CLI version instead of @latest, and treat the wttr.in example as unsafe or remove it before relying on the skill.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:101
Finding: Search Queries Are Sent over Plaintext HTTP to an Unrelated External Service
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:89
Finding: Mutable ClawHub CLI Package Is Downloaded and Executed Through npx
Content: View full analysis
Remediation: View remediation
install chinese-search ``` For publication: ```bash npx --yes clawhub@ publish ``` The hardening plan should also include: 1. Record the reviewed package version in the documentation. 2. Verify the package provenance, publisher identity, and registry before execution. 3. Validate the downloaded package against an expected integrity hash where the workflow supports it. 4. Prefer a project-local, lockfile-controlled dependency over ad hoc remote execution. 5. Review release notes and package contents before upgrading the pinned version. 6. Run publication tooling with a minimally privileged account and from a directory containing only intended release files. 7. Avoid exposing unrelated credentials or sensitive environment variables to installation and publication commands. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The documentation instructs users to run npx clawhub@latest publish, which fetches and executes the latest package version at runtime instead of a reviewed, pinned release. If the upstream package is compromised or a breaking/malicious version is published, users following these instructions could execute attacker-controlled code on their system.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This second command also uses npx clawhub@latest publish chinese-search, which dynamically resolves and executes the newest package version. That creates a supply-chain risk because anyone following the guide may run unreviewed code if the package or publishing account is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documentation instructs users to run npx clawhub@latest publish, which fetches and executes the latest package version at runtime rather than a pinned, reviewed release. If the package is compromised, typo-squatted, or a malicious update is published, users could execute attacker-controlled code on their machine during the release process.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The checklist is entirely written in Chinese and explicitly brands the skill as "Chinese Search," which indicates a fixed language/locale context. Under the policy, forcing a specific language without user opt-in or a clearly documented region-specific justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The quickstart instructs users to run npx clawhub@latest install chinese-search, which pulls and executes the latest published package version at install time rather than a pinned, reviewed version. If the upstream package is compromised, typosquatted, or a malicious update is published, users could execute attacker-controlled code simply by following the documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README presents the skill entirely in Chinese and positions it for Chinese users, but it does not state that the language/locale limitation is intentional or provide user choice. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx clawhub@latest install chinese-search, which executes a remote package at an unpinned version. If the upstream package or one of its dependencies is compromised, users could run attacker-controlled code during installation. In a setup/install context, this is a real supply-chain risk because the command is presented as the recommended path.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents shell-capable usage via curl commands but does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing tool restrictions can cause the skill to be invoked with broader shell access than intended, increasing the chance of arbitrary command execution or unsafe network access if later extended or interpreted automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description and title present the skill as explicitly Chinese-only (e.g. "中文搜索增强") and all usage examples assume Chinese queries, but the document does not state that this locale restriction is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx clawhub@latest install chinese-search pulls and executes the latest published package version at install time, which is a supply-chain risk. If the upstream package is compromised or a malicious version is published, users may execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire file is written as a Chinese-only skill artifact and explicitly emphasizes Chinese-specific behavior such as '中文优化' and Chinese-only search engines, without offering any language or locale choice. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the regional constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description explicitly states the skill is for Chinese search enhancement and integrates Chinese search engines, which implies a fixed language/locale behavior. In this manifest, there is no indication of user opt-in, language choice, or justification that this is a region-specific tool, so it may violate the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends the user-supplied query to multiple third-party search engines without notice, consent, or any minimization of disclosure. Queries may contain sensitive terms, and broadcasting them to six external services increases privacy risk, logging exposure, and cross-service profiling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file is natural-language documentation, so policy checks apply. The content appears to require Chinese for all usage guidance without offering an alternate language or stating that the skill is intentionally region/language-specific, which can violate a language-choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file includes example commands that send user-supplied search terms to external services such as Baidu, Bing China, and Sogou. The description does not include any privacy or data-disclosure warning, even though search queries may contain sensitive user or business information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The release notes and skill naming are presented entirely in Chinese, including the title and core description, with no indication that users may opt into another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Comments and output strings are entirely in Chinese, and the script is framed as a Chinese search engine test script, which imposes a language/locale constraint without any user opt-in or documented justification. This may violate language or locale policy where skills should not force a specific language unless clearly optional or region-specific by design.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description says the skill integrates Chinese search engines such as Bing China and Sogou Weixin, which implies a limited MVP scope centered on those named providers. This test script additionally queries Baidu, Zhihu, 360 Search, and Toutiao, expanding the effective behavior beyond the described MVP engine set.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.