Security audit

Websearch

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real web search skill, but it needs Review because its Google mode runs Chromium without its sandbox and the install instructions rely on mutable latest dependencies.

Install only if you are comfortable with your searches being sent to third-party search engines and with the Google path running a headless browser. Avoid sensitive queries, prefer limiting engines to the non-Google HTTP engines unless needed, do not run it as root, and use pinned/reviewed dependency versions where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Mutable and Unpinned Third-Party Installation Artifacts
Content: View full analysis
Remediation: View remediation
`. 3. Use package hashes through a hash-locked requirements file and install with hash verification where supported. 4. Pin Git-based installation instructions to a reviewed release tag or immutable commit hash. Prefer signed and verified releases. 5. Document the expected Playwright Chromium revision and verify downloaded artifacts using publisher-provided integrity metadata. 6. Add automated dependency scanning and a controlled update process that reviews new versions before changing pins. 7. Advise users not to perform installation as `root` or through unnecessary privilege elevation. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/google_headless.py:27
Finding: Chromium Process Isolation Disabled with --no-sandbox
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README promotes multi-engine search across several third-party providers and Google via headless Chromium, but does not clearly warn users that their queries will be transmitted to multiple external services. This can expose sensitive prompts, internal terms, or personal data to multiple parties, and the Google headless flow increases network/privacy exposure beyond what some users may expect.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx clawhub@latest install multi-engine-websearch, which fetches and executes the latest published package version at install time. This creates a supply-chain risk because a compromised or malicious future release of clawhub could execute arbitrary code on the user's machine during installation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill explicitly performs web searches across multiple engines and therefore requires network access, yet the manifest does not declare any tool scope or permissions. This weakens least-privilege controls and can cause the agent platform to grant or infer broader capabilities than are transparently documented, increasing the chance of unintended external requests or policy bypass.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The installation guidance uses 'npx clawhub@latest', which pulls whatever version is current at execution time rather than a reviewed, fixed release. This creates a supply-chain risk where a compromised or breaking upstream package version could be installed and executed automatically by users.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The 'When to Use' section is extremely broad, covering nearly any request involving information lookup, facts, news, products, or people. Overly general invocation guidance can cause the agent to trigger networked search for ordinary user requests without sufficient necessity, increasing data exposure, unnecessary browsing, and the chance of acting on untrusted web content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code forces locale and regional settings through locale="en-US" and by appending hl=en&gl=us to the Google query URL. This is a natural-language policy concern because it constrains language/locale behavior without offering the user a choice or documenting an opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest says the skill supports 6 engines: DuckDuckGo, DDG Lite, Yahoo, Yahoo JP, Startpage, and Google. This documentation instead presents reliability guidance for additional engines such as Bing, Brave, Mojeek, Yandex, Ask, and Baidu, and the fallback command at L22 recommends using duckduckgo,bing,brave,startpage. That creates an intent/documentation mismatch about what the skill actually supports.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.