WebSearch
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: websearch Version: 1.0.0 The skill is classified as suspicious due to a potential shell injection vulnerability in `skill.yaml`. The user-provided `query` input is directly interpolated into the `args` array for the `/usr/local/bin/websearch` command without apparent sanitization or escaping. This could allow an attacker to inject arbitrary shell commands if the `websearch` executable or the underlying execution environment processes the argument string as a shell command, leading to Remote Code Execution (RCE).
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the local websearch executable has been replaced or behaves differently than expected, the skill would run that code when invoked.
The skill executes a local helper binary that is not included in the provided artifacts. This is central to the stated purpose, but the trustworthiness of that local command determines what actually runs.
exec:
command: /usr/local/bin/websearch
args:
- "{{query}}"Before installing or using the skill, verify that /usr/local/bin/websearch is present, expected, and maintained by a trusted source.