Curated Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:06 PM UTC
• Version: 1.0.7

Overview

This is a legitimate local documentation search skill, but its optional crawler has network-safety gaps that merit review before installation.

Install only if you are comfortable with a Node-based local search tool that can optionally crawl the web. Run searches locally, keep the crawler disabled unless needed, review config.yaml before crawling, avoid adding untrusted domains, run crawls in a network-restricted environment if possible, and update dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/crawler.js:316

Finding

Whitelist Bypass Through Unvalidated Redirects and DNS Resolution

Content

View full analysis

pattern.test(hostname)); } // If it's an IPv6 address (simplified check) if (hostname.includes(':') && /^[0-9a-fA-F:]+$/.test(hostname.replace(/:/g, ''))) { // For simplicity, check if hostname looks like IPv6 and matches patterns // A full IPv6 parser would be better but this catches common private ranges // Also catch IPv6 unique local (fc00::/7) by checking for fc/fd prefix if (/^f[cd]/i.test(hostname)) return true; return BLOCKED_IP_PATTERNS.some(pattern => pattern.test(hostname)); } // Hostnames (domain names) are not blocked return false; } ``` ### Technical Analysis The crawler validates only the textual hostname when a URL is enqueued. It does not resolve hostnames and validate every resulting IP address before connecting. Consequently, an allowed hostname can resolve ...[truncated 2125 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/crawler.js:437

Finding

Unbounded HTTP Response Buffering Enables Resource Exhaustion

Content

View full analysis

this.maxContentLength) { ``` ### Technical Analysis The crawler calls `resp.text()`, which buffers the complete response body in memory. The full HTML is then parsed by JSDOM and cloned before the extracted text is compared with `maxContentLength`. The configured content-size limit therefore limits only the final indexed text. It does not limit downloaded bytes, the size of the original HTML string, or the memory and CPU requ ...[truncated 1418 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Request scheduling, robots.txt handling, and rate limiting are crawler behaviors, not pure search behaviors, so their presence supports a capability mismatch. The contextual risk is somewhat reduced because these controls are protective rather than overtly dangerous, but undisclosed network behavior still affects trust and approval decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Request scheduling, robots.txt handling, and rate limiting are crawler behaviors, not pure search behaviors, so their presence supports a capability mismatch. The contextual risk is somewhat reduced because these controls are protective rather than overtly dangerous, but undisclosed network behavior still affects trust and approval decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Request scheduling, robots.txt handling, and rate limiting are crawler behaviors, not pure search behaviors, so their presence supports a capability mismatch. The contextual risk is somewhat reduced because these controls are protective rather than overtly dangerous, but undisclosed network behavior still affects trust and approval decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Request scheduling, robots.txt handling, and rate limiting are crawler behaviors, not pure search behaviors, so their presence supports a capability mismatch. The contextual risk is somewhat reduced because these controls are protective rather than overtly dangerous, but undisclosed network behavior still affects trust and approval decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Request scheduling, robots.txt handling, and rate limiting are crawler behaviors, not pure search behaviors, so their presence supports a capability mismatch. The contextual risk is somewhat reduced because these controls are protective rather than overtly dangerous, but undisclosed network behavior still affects trust and approval decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Request scheduling, robots.txt handling, and rate limiting are crawler behaviors, not pure search behaviors, so their presence supports a capability mismatch. The contextual risk is somewhat reduced because these controls are protective rather than overtly dangerous, but undisclosed network behavior still affects trust and approval decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Request scheduling, robots.txt handling, and rate limiting are crawler behaviors, not pure search behaviors, so their presence supports a capability mismatch. The contextual risk is somewhat reduced because these controls are protective rather than overtly dangerous, but undisclosed network behavior still affects trust and approval decisions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/deployment.md (reported line 173)May include surrounding context.

If index is corrupted:

bash

rm data/index.json data/index-docs.json
npm run crawl

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==3.1.2 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document specifies MDN crawling under /en-US/docs/Web/ and elsewhere centers English-only sources such as en.wikipedia.org and a StackPrinter language=en example. Because this is natural-language guidance for domain selection and crawling strategy, it imposes an English locale by default rather than offering a language choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises local/offline search behavior but declares no explicit permission or tool scope despite documented capabilities that include local environment/file access and optional outbound network use during crawling. Missing scope declarations weaken sandboxing and user understanding, making it easier for a skill to exercise broader capabilities than expected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/deployment.md (reported line 30)May include surrounding context.

2.1 Cron Job (Simple)

bash

# crontab -e (for user 'q')
0 2 * * 0 cd /home/q/.openclaw/workspace/skills/curated-search && /usr/bin/npm run crawl >> /var/log/curated-search/crawl.log 2>&1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/deployment.md (reported line 84)May include surrounding context.

bash

# Copy to systemd directory (as root)
sudo cp systemd/curated-search-crawler.service systemd/curated-search-crawler.timer /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now curated-search-crawler.timer

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/deployment.md (reported line 85)May include surrounding context.

bash

# Copy to systemd directory (as root)
sudo cp systemd/curated-search-crawler.service systemd/curated-search-crawler.timer /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now curated-search-crawler.timer

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/deployment.md (reported line 86)May include surrounding context.

bash

# Copy to systemd directory (as root)
sudo cp systemd/curated-search-crawler.service systemd/curated-search-crawler.timer /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now curated-search-crawler.timer

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/deployment.md (reported line 86)May include surrounding context.

Copy to systemd directory (as root)

sudo cp systemd/curated-search-crawler.service systemd/curated-search-crawler.timer /etc/systemd/system/ sudo systemctl daemon-reload sudo systemctl enable --now curated-search-crawler.timer

text

**Check status**:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The markdown provides a command to delete data/index.json and data/index-docs.json as a recovery step, but does not explicitly warn that this permanently removes the local search index until a re-crawl completes. For markdown files, destructive actions affecting user data or system state should include a clear warning.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/deployment.md (reported line 284)May include surrounding context.

Recommended permissions:

bash

chmod 750 ~/.openclaw/workspace/skills/curated-search
chmod 640 config.yaml
chmod 600 data/*.json  # optional

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/deployment.md (reported line 285)May include surrounding context.

Recommended permissions:

bash

chmod 750 ~/.openclaw/workspace/skills/curated-search
chmod 640 config.yaml
chmod 600 data/*.json  # optional

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/deployment.md (reported line 286)May include surrounding context.

bash

chmod 750 ~/.openclaw/workspace/skills/curated-search
chmod 640 config.yaml
chmod 600 data/*.json  # optional

---

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The security manifest states that no environment variables are accessed, but the script explicitly forwards the full parent environment to the spawned child process via env: process.env. Even if this health check does not directly read secrets itself, the child process can access all inherited variables, which can expose credentials, tokens, or proxy settings if search.js or its dependencies are compromised or behave unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/health-check.js:42