ClawHub
Back to skill

Security audit

Ddg Search Fetch

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward DuckDuckGo search and page-fetch skill, with normal web-query privacy and broad URL-fetching risks users should understand.

Install only if you are comfortable sending search terms and requested URLs to third-party web services. Avoid using it for secrets, internal-only links, localhost/private-network targets, or sensitive investigation terms, and treat fetched page text as untrusted web content rather than instructions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill documentation shows executable commands that perform both shell execution and outbound network access, but no permissions are declared to signal or constrain those capabilities. This creates a transparency and policy-enforcement gap: agents or users may invoke web requests and command execution without clear consent boundaries, increasing the risk of unintended data egress or unsafe execution in environments that rely on declared permissions.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are broad and generic, such as 'search for', 'look up', and 'find information about', which can match many normal user requests. In an agent environment this can cause accidental invocation of the skill, leading to unnecessary external requests, privacy leakage of user prompts, or routing away from safer built-in capabilities.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The description promotes web search and URL fetching through DuckDuckGo and remote websites but does not warn that user queries and supplied URLs will be transmitted to external services. This omission can mislead users and operators about data exposure, especially when prompts may contain sensitive terms, internal URLs, or confidential investigation targets.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.