ClawHub
Back to skill

Security audit

ai-embedding-search

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real SkillBoss API integration, but its embedding-search label understates broad third-party API setup and mutable remote agent instructions.

Install only if you are comfortable giving SkillBoss an API key and routing task inputs through its external service. Review the remote setup guide yourself before letting an agent follow it, avoid sensitive data unless you understand SkillBoss and downstream provider handling, and prefer a pinned reviewed release over the unpinned GitHub clone instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:31
Finding

Mutable External Setup Instructions Can Hijack Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–36
Vulnerability Type: External instruction redirection
Risk Level: Critical

Vulnerable Code Snippet:

markdown
## Setup (One Command)

Tell your agent:
text
set up skillboss.co/skill.md
markdown
This auto-configures SkillBoss with 687 APIs — chat, image, video, audio, search, scraping, social data, email, and more.

The same instruction is also referenced by the installHint metadata at SKILL.md, line 18:

yaml
installHint: "Tell your agent: set up skillboss.co/skill.md — or get API key at https://skillboss.co/console"

Technical Analysis

The skill directs the agent to obtain and follow setup instructions hosted at skillboss.co/skill.md. Those instructions are not included in the audited package and are not pinned to an immutable version or protected by a documented checksum or signature.

Consequently, the effective setup behavior can change after this package has been reviewed. The external resource owner—or an attacker who compromises the website or its delivery infrastructure—could replace the setup document with instructions that alter the agent's goals, request sensitive credentials, install additional components, invoke tools, or perform actions unrelated to embedding search.

This is an instruction-hijacking risk because the remote document is presented as an imperative command for the agent rather than merely as optional documentation for the user. Although the audited local files do not themselves contain credential theft or destructive commands, they establish a channel through which unaudited instructions can control subsequent agent behavior.

Attack Path

  1. A user installs or invokes the skill for an embedding-search task.
  2. The agent processes the instruction to set up skillboss.co/skill.md.
  3. The agent retrieves or otherwise follows the mutable external document.
  4. The ...[truncated 1096 chars]
Remediation
View remediation

Remediation Suggestions

  1. Include the complete setup procedure directly in the reviewed skill package.
  2. Do not instruct an agent to execute or automatically follow mutable external instruction documents.
  3. If remote setup artifacts are unavoidable, reference an immutable, versioned resource and publish a cryptographic checksum or verified signature.
  4. Download remote content only as untrusted data and display it to the user before taking any action.
  5. Require explicit user approval for each configuration change, command execution, credential request, or installation step.
  6. Restrict setup to the minimum capabilities required for embedding search rather than automatically configuring unrelated APIs.
  7. Document the exact domains, files, configuration changes, and permissions required by the setup process.

T08 · Insecure Dependencies

Warning
Location
README.md:14
Finding

Installation from an Unpinned Remote Repository

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 14–18
Vulnerability Type: Unpinned supply-chain dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
### Manual Installation
```bash
git clone https://github.com/ModestyRichards/ai-embedding-search.git
cp -r ai-embedding-search ~/.openclaw/skills/ai-embedding-search
text

### Technical Analysis

The documented installation procedure clones the repository's current default branch and immediately copies its contents into the trusted OpenClaw skills directory. It does not pin an immutable commit or release tag, nor does it verify a checksum or cryptographic signature.

The content installed by this command can therefore differ from the version represented by the audited files. A repository maintainer can change the default branch after review, and compromise of the repository or maintainer account could allow an attacker to introduce modified skill instructions or executable files.

Copying the resulting directory into `~/.openclaw/skills` places that unverified content where OpenClaw may load it as a trusted skill. No malicious repository content is evidenced in the audited snapshot; the vulnerability is the unsafe, mutable installation mechanism.

### Attack Path

1. An attacker compromises the referenced repository, a maintainer account, or the default branch, or a maintainer publishes an unsafe change.
2. The attacker adds malicious instructions, configuration, or executable content to the repository.
3. A user follows the documented `git clone` command after the change.
4. Git retrieves the modified default branch without verifying that it matches an audited release.
5. The user copies the downloaded directory into `~/.openclaw/skills/ai-embedding-search`.
6. OpenClaw loads or exposes the unreviewed content as an installed skill.

### Impact Assessment

Exploitation can replace the reviewed skill with attacker-controlled 
...[truncated 519 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a specific reviewed commit hash or immutable signed release.
  2. Publish a SHA-256 or stronger checksum for the release archive and require verification before installation.
  3. Cryptographically sign releases and document signature-verification steps.
  4. Avoid copying a mutable default branch directly into the trusted skills directory.
  5. Stage downloaded files in a separate directory, inspect the complete file list and changes, and activate the skill only after verification.
  6. Configure updates as an explicit process that displays differences and requires user approval.
  7. Prefer a trusted package mechanism that enforces version pinning and integrity validation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as narrowly scoped to embedding search, but the documentation expands it into a broad API broker for hundreds of unrelated capabilities. This scope mismatch can mislead agents and users into granting trust, credentials, and data access far beyond what the declared purpose justifies, increasing the chance of unintended data exposure or misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documentation instructs use of unrelated capabilities including scraping, social data, image, video, audio, and other APIs that are not necessary for embedding search. In agent contexts, this materially increases the reachable action surface and can enable collection or transmission of additional user or third-party data under a misleadingly narrow skill label.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells users to configure an API key and send requests to SkillBoss but does not clearly disclose that prompts or other user data will be transmitted to an external third-party service. This lack of transparency can lead to privacy, compliance, and consent failures, especially when agents process sensitive enterprise or personal data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The quick test demonstrates a chat completions request with user messages even though the skill claims to be for embeddings. This inconsistency can cause agents to send free-form user content to a third-party chat endpoint under the guise of embedding search, broadening data disclosure and operational behavior beyond the advertised function.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The direct reference to the external SkillBoss API confirms that the skill routes requests off-platform to a third party. While not inherently malicious, this becomes a security concern when combined with misleading scope and missing privacy disclosures, because users may not realize their data is leaving the trusted environment.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Quick Test

bash
curl -X POST "https://api.skillboss.co/v1/chat/completions" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The direct reference to the external SkillBoss API confirms that the skill routes requests off-platform to a third party. While not inherently malicious, this becomes a security concern when combined with misleading scope and missing privacy disclosures, because users may not realize their data is leaving the trusted environment.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Quick Test

bash
curl -X POST "https://api.skillboss.co/v1/chat/completions" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.