ClawHub
Back to skill

Security audit

wild-idea

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed brainstorming tool that uses local scripts and Tavily web searches; the main caution is that search queries and a Tavily API key are involved.

Install only if you are comfortable with local command execution and Tavily searches. Use a dedicated, revocable Tavily API key, and avoid using the skill with confidential project names, private strategy, or sensitive prompt details unless sending related search terms to Tavily is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The example goes beyond passive documentation by instructing the reader to read a local secret from ~/.openclaw/.env and use shell/network commands to contact a third-party service. In a skill context, embedding credential access and outbound request patterns increases the chance that an agent or operator will copy unsafe behavior and expose local secrets during normal use.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The manifest description is broadly scoped and does not clearly constrain when or how the skill should activate, which can cause the agent to invoke it in contexts the user did not intend. In this skill, the expansive 'wild domain injection' behavior and lack of trigger boundaries increase the chance of unexpected prompt steering and irrelevant or disruptive output.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The manifest declares use of TAVILY_API_KEY for web verification/search but provides no user-facing disclosure that prompts or derived queries may be sent to an external service. This creates a data-handling and consent risk, especially because the skill description suggests automatic web searches as part of normal operation.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The description indicates random Chinese character web search behavior without any user opt-in, imposing a language/locale-specific action that may be unrelated to user intent. Because this behavior is tied to external search, it can generate unexpected outbound queries and culturally or contextually inappropriate results.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The command retrieves an API key from a local env file and transmits it in an outbound HTTP request without any consent prompt, disclosure, or trust-boundary warning. Even if the destination is intended, silently teaching secret extraction plus network transmission is dangerous because it normalizes credential handling that can leak or be repurposed to other endpoints.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script sends the query to an external helper that likely performs a network search, but the CLI provides no disclosure, consent step, or privacy warning. In an agent-skill context, this is more dangerous because user-supplied or generated text may be transmitted off-box unexpectedly, potentially exposing sensitive prompts, proprietary terms, or personal data to third-party services.

External Transmission

Medium
Category
Data Exfiltration
Content
KEY=$(grep TAVILY_API_KEY ~/.openclaw/.env | cut -d'=' -f2)

# 单条搜索
curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "'"$KEY"'",
Confidence
72% confidence
Finding
curl -s "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
for q in queries:
    r = terminal(
        f'''curl -s "https://api.tavily.com/search" -H "Content-Type: application/json" -d '{{
            "api_key": "{key}",
            "query": "{q}",
            "search_depth": "basic",
Confidence
80% confidence
Finding
curl -s "https://api.tavily.com/search" -H "Content-Type: application/json" -d

External Transmission

Medium
Category
Data Exfiltration
Content
KEY=$(grep TAVILY_API_KEY ~/.openclaw/.env | cut -d'=' -f2)

# 单条搜索
curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "'"$KEY"'",
Confidence
72% confidence
Finding
https://api.tavily.com/

External Transmission

Medium
Category
Data Exfiltration
Content
for q in queries:
    r = terminal(
        f'''curl -s "https://api.tavily.com/search" -H "Content-Type: application/json" -d '{{
            "api_key": "{key}",
            "query": "{q}",
            "search_depth": "basic",
Confidence
80% confidence
Finding
https://api.tavily.com/

Credential Access

High
Category
Privilege Escalation
Content
import json
from hermes_tools import terminal

key = terminal("grep TAVI ~/.openclaw/.env | cut -d'=' -f2", timeout=5)['output'].strip()

queries = [
    "候选建议1",
Confidence
96% confidence
Finding
.env

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.