Security audit

ClawSearch Ultra

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a web-search helper with expected local caching/monitoring behavior, but it is packaged incompletely and overstates some capabilities.

Install only if you are comfortable running a community search helper that may send queries to configured search providers and store monitored result URLs locally. Treat the package as incomplete until its missing lib modules are supplied, and avoid sensitive monitored topics if real Slack or Telegram notifications are later implemented.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: The manifest describes a federated web-search skill with answer-first results. This file implements that by invoking `search.mjs` through `execFileSync`, which introduces subprocess execution rather than directly calling shared logic. While used here as a wrapper implementation, process spawning is a broader capability than the stated search function and is not explicitly justified by the manifest description.

Description-Behavior Mismatch

Low

Confidence: 89% confidence
Finding: The manifest describes federated search across 10+ search engines and explicitly names Brave, but this file hard-codes only five sub-engine names and derives provider IDs from installed providers without any visible guarantee of 10+ coverage. The user-facing CLI help also advertises --search-engine choices that exclude Brave, creating a concrete mismatch between the claimed breadth and the implemented interface in this command.

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The usage text is the primary inline documentation for this file, and it identifies the tool as "web-search-pro" rather than the manifest's skill name. That is an intent/documentation divergence because the code documentation presents a different product identity than the declared skill being audited.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest describes a federated web search skill that returns search results, but this file implements a separate monitoring workflow: it stores prior search result URLs under a temp-directory baseline and compares future runs to show only new results. That persistent news/watch capability goes beyond ordinary one-shot search behavior and is not disclosed in the manifest description.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: A search skill is expected to make network requests and return results, but this script also creates a local state directory and later writes per-query history files to track changes across executions. Persistent local storage of search history is a distinct monitoring/stateful capability that is not justified by the manifest’s description of federated search alone.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: In this markdown file, the skill explicitly describes a monitoring feature that can notify via Telegram or Slack. Because those notifications necessarily involve external transmission of user query context or result-derived content, the documentation should warn users about the privacy implications.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The usage text and examples are presented only in Danish, and the script branding/comments also indicate a Danish-only interaction model. This creates a language/locale policy concern because the skill imposes a specific language on users without any documented opt-in or alternative locale support.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: This code persists search-result state under the system temp directory to track new results across runs, but there is no confirmation prompt, comment/docstring warning, or user-facing message disclosing that local data will be written. For a code file, file writes should have at least some visible disclosure unless clearly covered elsewhere.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: All visible usage/help strings and status messages are presented only in Danish, which imposes a specific language on users without any opt-in or alternative. The policy allows locale constraints only when explicitly documented and justified, which is not present here.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/answer.mjs:35