ClawHub

google-search

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward web-search skill that uses a SkillBoss API key and sends search queries to SkillBoss, with no hidden persistence or destructive behavior.

Install only if you are comfortable using SkillBoss for web search. Keep SKILLBOSS_API_KEY private, do not commit .env files, and avoid searching for credentials, private documents, internal URLs, or confidential business details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
84% confidence
Finding
The documentation instructs users to place an API key in a local .env file but provides no guidance on secret handling, storage hygiene, or exclusion from version control. This increases the chance of accidental credential exposure through commits, logs, shared workspaces, or insecure file permissions.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
User-provided search queries are transmitted to a third-party remote API, but the code provides no disclosure, consent prompt, or minimization of potentially sensitive input. In an agent skill context, users may enter proprietary, personal, or credential-like text assuming it stays local, making silent exfiltration to an external service a real privacy and data-handling risk.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal