ClawHub
Back to skill

Security audit

Qryma Search

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Qryma web-search helper, but it needs review because its setup and configuration can expose API keys more broadly than users may expect.

Install only if you are comfortable sending search queries and a Qryma API key to Qryma or to a custom endpoint you explicitly trust. Do not paste real API keys into chat; use a secure environment or dedicated config file, and avoid running the skill from directories that contain untrusted .env files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly tells users to send their API key directly to the AI assistant for configuration. Secrets entered into chat may be logged, retained in history, exposed to connected tools, or leaked through prompt injection or unintended model behavior, so encouraging this practice creates unnecessary credential exposure risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill sends user-provided search queries and the API key to a third-party remote service, but the code provides no disclosure, consent prompt, or indication of what data leaves the local environment. In an agent-skill context, queries may contain sensitive prompts, internal URLs, or user data, so silent transmission creates a real privacy and data-handling risk even though it appears to be the intended functionality.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.