ClawHub
Back to skill

Security audit

Querit Web Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Querit web-search integration that sends search queries and its configured Querit API key to Querit's API when invoked.

Install this only if you are comfortable giving the skill a Querit API key and sending your search queries or advanced JSON search payloads to Querit. Do not include passwords, tokens, private internal URLs, customer data, or other sensitive material in searches.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'headers' from os.getenv (line 21, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}

    try:
        response = requests.post(url, headers=headers, json=payload_data, timeout=30)
        response.raise_for_status()
        return json.dumps(response.json(), indent=2)
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes a Python script, requires an API key from the environment, and performs networked web searches, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause the runtime or reviewers to underestimate the skill's capabilities, increasing the risk of unintended network access or environment-secret use.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger conditions are broad enough to activate on many generic requests for current facts or news, which makes over-invocation likely. In a skill with network access and API-key usage, broad matching increases the chance of unnecessary external requests, data exposure through queries, or the skill being selected when a safer/local alternative would suffice.

External Transmission

Medium
Category
Data Exfiltration
Content
return json.dumps({"error": "QUERIT_API_KEY environment variable is missing. Please configure it in OpenClaw."})

    # Replace with the actual Querit POST endpoint URL
    url = "https://api.querit.ai/v1/search"

    headers = {
        "Authorization": f"Bearer {api_key}",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
}

    try:
        response = requests.post(url, headers=headers, json=payload_data, timeout=30)
        response.raise_for_status()
        return json.dumps(response.json(), indent=2)
Confidence
80% confidence
Finding
This code performs external network transmission of caller-controlled data to a third-party API. While expected for a web search skill, it still creates a real data-exposure boundary because any supplied payload is exported off-host, and in an agent environment that can leak sensitive prompt, user, or enterprise data if upstream controls are weak.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script sends arbitrary user-provided query content directly to a third-party service without any disclosure, consent checkpoint, or data-sensitivity guardrails. In an agent skill context, users may unknowingly include secrets, internal URLs, or sensitive business data in queries, causing unintended external data exposure.

Static analysis

No suspicious patterns detected.