Serper Clone

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward self-hosted search connector, with some setup and transport-security caveats users should understand.

Install only if you operate or trust the configured Serper Clone endpoint. Prefer HTTPS for BASE_URL, avoid sending sensitive searches over plaintext HTTP, protect and rotate the API key, and treat the shell helper as an example rather than a robust wrapper for untrusted query text.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:80

Finding

API Credentials and Search Queries May Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36-38 and SKILL.md:80-84
Vulnerability Type: Plaintext transmission of sensitive information
Risk Level: Medium

The documented configuration explicitly permits an unencrypted HTTP base URL:

text

After deployment, note your:
- **Base URL** (e.g., `https://search.example.com` or `http://192.168.1.50:8080`)
- **API key** (configured during setup)

Requests then transmit the API key in a header and the search query in the request body:

bash

curl -s -X POST "$BASE_URL/search" \
  -H "X-API-KEY: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q": "search query", "num": 10}' | jq .

Technical Analysis

The skill does not require the configured BASE_URL to use HTTPS. When a user follows the documented HTTP example, TLS provides neither confidentiality nor integrity for requests or responses.

The X-API-KEY header and JSON request body are therefore visible to any party able to observe traffic between the OpenClaw host and the search server. A network-positioned attacker can also alter requests or responses in transit because the client has no authenticated encrypted channel to the server.

Attack Path

1. A user configures BASE_URL with the documented http:// scheme.
2. The skill loads the API key from ~/.openclaw/workspace/.serper-clone-api-key.
3. The skill submits a search request containing the key in X-API-KEY and the user's query in the JSON body.
4. An attacker with access to the relevant network path, such as a shared wireless network, local network segment, proxy, or container overlay, captures the plaintext request.
5. The attacker recovers the API key and private search terms.
6. The attacker may reuse the key against the configured service or modify returned search results before they reach the agent.

Impact Assessment

Successful exploitation can disclose the configured Serper Clone AP ...[truncated 550 chars]

Remediation

View remediation

Remediation Suggestions

• Require BASE_URL to use the https:// scheme and reject unsupported or insecure schemes before sending credentials.
• Remove the general-purpose http://192.168.1.50:8080 example from the documentation.
• If plaintext HTTP is operationally necessary for local development, restrict it explicitly to loopback addresses such as 127.0.0.1 or ::1 and document that it must not be used across a network.
• Preserve certificate and hostname verification in curl; do not recommend options such as --insecure.
• Recommend a private certificate authority or a reverse proxy with TLS for self-hosted deployments.
• Use narrowly scoped, revocable API keys and rotate any key suspected of having traversed an untrusted plaintext connection.
• Clearly warn that both credentials and search queries are sensitive and must only be sent through an authenticated encrypted channel.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

Copy the SKILL.md file into your OpenClaw skills directory:

bash

mkdir -p ~/.openclaw/workspace/skills/serper-clone
cp SKILL.md ~/.openclaw/workspace/skills/serper-clone/

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

bash

echo "API_KEY=your-api-key-here" > ~/.openclaw/workspace/.serper-clone-api-key
echo "BASE_URL=https://your-serper-clone-host" >> ~/.openclaw/workspace/.serper-clone-api-key
chmod 600 ~/.openclaw/workspace/.serper-clone-api-key

The skill activates automatically once the API key file is in place.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

bash

echo "API_KEY=your-api-key-here" > ~/.openclaw/workspace/.serper-clone-api-key
echo "BASE_URL=https://your-serper-clone-host" >> ~/.openclaw/workspace/.serper-clone-api-key
chmod 600 ~/.openclaw/workspace/.serper-clone-api-key

The skill activates automatically once the API key file is in place.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

2. Configure the Skill

Create the API key file:

bash

echo "API_KEY=your-api-key-here" > ~/.openclaw/workspace/.serper-clone-api-key

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Web Search

bash

curl -s -X POST "$BASE_URL/search" \
  -H "X-API-KEY: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q": "search query", "num": 10}' | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

News Search

bash

curl -s -X POST "$BASE_URL/news" \
  -H "X-API-KEY: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q": "latest AI news", "num": 5}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The helper function interpolates the user-controlled query directly into a JSON string passed to curl, without safe JSON escaping. A crafted query containing quotes or JSON syntax could break the request structure, alter request parameters, or cause malformed requests to the remote service.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

local api_key=$(grep '^API_KEY=' ~/.openclaw/workspace/.serper-clone-api-key | cut -d'=' -f2)
  local base_url=$(grep '^BASE_URL=' ~/.openclaw/workspace/.serper-clone-api-key | cut -d'=' -f2)

  curl -s -X POST "$base_url/$endpoint" \
    -H "X-API-KEY: $api_key" \
    -H "Content-Type: application/json" \
    -d "{\"q\": \"$query\", \"num\": $num}"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

## Security Notes

- The API key file should be `chmod 600` (owner-read only)
- All requests stay between your OpenClaw instance and your Serper Clone instance
- No data is sent to any third-party service
- The skill only activates when the API key file exists

Static analysis

No suspicious patterns detected.