ClawHub

Volcengine Web Search

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Volcengine web search helper that sends user search requests and an API key to its stated third-party endpoint, with no evidence of hidden persistence or unrelated behavior.

Install this only if you intend to use the devtool.uk/Volcengine search service. Keep the AZT_API_KEY scoped to this service, understand that searches and the key are sent to the listed endpoint, and avoid setting the key globally if you do not want agents to use it automatically for broad web-search requests.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description is broad enough to match many generic requests for searching the web, summarized browsing, or reading search results, which can cause the skill to be invoked more often than intended. Overbroad matching increases the chance that user queries and API-backed actions are routed to this external service without sufficiently clear user intent or least-privilege selection.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation conditions list positive triggers but provide no boundaries or negative examples, so the agent may select this skill for common browsing-like requests without clear necessity. In this context, that is more dangerous because the skill uses network access and credentialed API calls, so accidental invocation can leak queries to a third-party service and consume paid resources.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal