ClawHub
Back to skill

Security audit

smartsearch

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent web-search skill, but users should review it because it can send queries to an external provider and its troubleshooting docs can expose the API key.

Install only if you are comfortable sending search queries, filters, and optionally extracted web content to Cloudsway. Do not include secrets, proprietary context, or personal data in searches, and avoid running troubleshooting commands that print the API key; use a presence check instead.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning

API Credential Disclosure Through Troubleshooting Command

SKILL.md:323

Vulnerability Details

File Location: SKILL.md, lines 323–325
Vulnerability Type: Exposure of sensitive credentials in terminal output
Risk Level: Medium

bash
echo $CLOUDSWAYS_AK

Technical Analysis

The troubleshooting documentation instructs users or agents to print the complete value of the CLOUDSWAYS_AK API credential. Although the command does not transmit the credential directly, its output may be retained in terminal transcripts, CI/CD logs, agent tool-call records, screen recordings, debugging artifacts, or support communications.

Printing the secret is unnecessary when determining whether the environment variable is configured. The command also leaves the expansion unquoted, although the primary security issue is disclosure of the complete credential rather than shell word splitting.

Attack Path

  1. A user or automated agent encounters an authentication or configuration problem.
  2. The user or agent follows the documented troubleshooting instruction.
  3. The shell expands CLOUDSWAYS_AK and prints the complete API key.
  4. The terminal output is captured in an agent trace, build log, support record, or shared screenshot.
  5. An unauthorized party with access to that output retrieves the credential.
  6. The party submits requests to the Cloudsway API using the exposed key.

Impact Assessment

Exploitation exposes the privileges assigned to the affected Cloudsway API key. An attacker could potentially make unauthorized search API requests, consume the account's quota, create billing impact, or interfere with service availability through quota exhaustion. The issue does not by itself provide local operating-system privileges or arbitrary code execution. Its scope is limited to the API permissions and account resources associated with the disclosed credential.

Remediation

Remediation Suggestions

Replace the credential-printing command with a presence check that never reveals the value:

bash
if [ -n "${CLOUDSWAYS_AK:-}" ]; then
    echo "CLOUDSWAYS_AK is set"
else
    echo "CLOUDSWAYS_AK is not set"
fi

Additional hardening measures:

  1. Explicitly warn users not to print, paste, log, or include the API key in support requests.
  2. Redact the credential from agent traces and CI/CD logs where environment values might be recorded.
  3. Store the key in an appropriate secret manager rather than plaintext configuration files.
  4. Rotate any key that has already been printed in retained or shared output.
  5. Apply API-side usage limits and monitoring to detect unauthorized requests or unexpected quota consumption.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
90% confidence
Finding

The skill's activation guidance is very broad, covering generic browsing, fact checking, research, and real-time information requests. In an agentic environment, this can cause the skill to trigger for many ordinary prompts and silently route user queries to an external service, increasing the chance of unnecessary data disclosure and reducing user control over when external search is used.

Missing User Warnings

Medium
Confidence
97% confidence
Finding

The documentation does not clearly warn that user queries and optionally retrieved webpage content are sent to an external API endpoint. Because the skill supports full content extraction and research workflows, users or orchestrating agents may disclose sensitive prompts, internal topics, or regulated data to a third party without informed consent, making this more dangerous in contexts involving proprietary or personal information.

Vague Triggers

Medium
Confidence
88% confidence
Finding

The trigger examples are open-ended and normalize activating the skill for broad research and verification tasks without clear limits. This makes it more likely an agent will invoke the external search capability for prompts that may contain confidential context, causing unintended transmission of user data to the third-party search provider.

Missing User Warnings

Medium
Confidence
92% confidence
Finding

This shell script sends the user-provided search query to an external API and includes an authorization credential in the request header. Although the script has usage text and an authentication check, it does not clearly warn the user at execution time that their query data is being transmitted to a remote service.

Static analysis

No suspicious patterns detected.