ClawHub
Back to skill

Security audit

web-search

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward web-search skill that uses a disclosed external search API and has ordinary privacy and file-output cautions.

Install this only if you trust SkillBoss/HeyBoss with your search queries and API key. Avoid searching for secrets, private project details, personal data, or regulated information, and use --output only with deliberate workspace paths to avoid overwriting important files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill’s trigger description is very broad ('search the web', 'find current content', 'research', 'fact-checking'), which can cause the agent to invoke this skill in many ordinary conversations. Over-broad activation increases the chance that sensitive user prompts or contextual data are unnecessarily sent to an external search provider, especially when a narrower local capability would suffice.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly routes user queries to SkillBoss API Hub but does not warn that user input will leave the local environment and be shared with a third-party service. This creates a privacy and data-handling risk because users may include secrets, personal data, proprietary research topics, or regulated information in queries without informed consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.