OpenClaw Docs Search

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed OpenClaw documentation lookup tool, with ordinary network-query and dependency hygiene risks but no hidden persistence, credential access, or destructive behavior found.

Install only if you are comfortable sending OpenClaw documentation search terms to the Mintlify/OpenClaw documentation services. Avoid putting secrets, private hostnames, customer names, or internal incident details into search queries, and prefer a dependency update before production use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Known Vulnerable Dependency: undici==7.24.5 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

undici 7.24.5 is a real runtime dependency pulled in through jsdom, and the advisory set indicates multiple HTTP parsing and connection-handling flaws that can lead to response confusion, cross-request data disclosure, or desynchronization issues. Because this skill performs real-time documentation retrieval over the network, an affected HTTP client in the dependency chain is materially relevant and increases the chance that malicious or malformed upstream responses could impact integrity or confidentiality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs the agent to perform outbound HTTP requests to third-party domains, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a capability/metadata mismatch that can lead to undeclared network access, weak policy enforcement, and accidental invocation in environments that rely on manifest-declared restrictions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation guidance is broad enough to trigger on a large class of routine OpenClaw-related tasks, including cases where external retrieval may be unnecessary. Overbroad triggering increases the chance of needless data transmission, dependency on external content, and unreviewed retrieval during operational or configuration workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The phrase 'before answering or taking action' is ambiguous and can be interpreted as a mandatory preflight step for many tasks. In practice, that can cause the agent to consult external services prior to responding, even when not required, creating avoidable privacy, safety, and availability risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Mandating translation of Chinese user intent into English keywords without opt-in can alter meaning and cause the agent to transmit transformed user queries to an external service in a way the user did not request. While not inherently severe, it introduces consent, fidelity, and privacy concerns, especially if user phrasing contains sensitive operational details.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill explicitly directs the agent to send user-derived search terms to an external endpoint, which is a real data egress path. Even though the destination appears related to documentation search, external transmission of queries can leak sensitive project names, internal configuration terms, or operational intent if the invocation conditions are too broad.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

You can retrieve results with the following curl command:

bash

curl --location --request POST 'https://leaves.mintlify.com/api/search/clawdhub' \
--header 'Content-Type: application/json' \
--data-raw '{
  "query": "<english search keywords>",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file contains multiple user-facing strings in Chinese, including the no-results message and CLI output/help text, while also exposing functions with a default language of English. For a general-purpose skill, forcing Chinese-language responses in these paths without explicit user choice can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The function signature restricts results to 'zh-Hans' or 'en' and defaults to 'en', which is a natural-language locale policy embedded in code. This may violate language-choice policy because users are steered into a specific language without explicit opt-in beyond these two options.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entry "Added English-first query guidance for better hit rate" describes a language preference that may steer use toward English by default. Under the policy rule for natural-language violations, forcing or prioritizing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README states that the skill 'prefers English queries' to improve search precision, which is a language-policy preference expressed in natural language. Because it does not clearly frame this as optional user choice or a narrowly justified locale requirement, it can conflict with a policy requiring language selection to remain user-driven.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These lines describe operational behavior that prioritizes English keywords. This is a natural-language locale constraint and may violate organizational language-choice policy when the user is not offered a choice or told that the preference is optional.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes a documentation retrieval skill for returning OpenClaw docs as compact Markdown, but this file also exposes a standalone command-line execution path via process.argv and require.main. While likely intended for local testing, accepting CLI modes and arguments is an extra capability not justified by the stated runtime skill purpose.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.4 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Using a caret version for the runtime dependency jsdom allows future minor/patch releases to be installed automatically, which can introduce an unintended vulnerable or malicious upstream package version through the supply chain. In a documentation-retrieval skill that parses remote content, runtime dependencies are security-relevant because they process untrusted external data.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json

"license": "ISC",
  "description": "Real-time search of the latest official OpenClaw docs with compact Markdown output for safer config, CLI, gateway, channels, and skills workflows.",
  "dependencies": {
    "jsdom": "^29.0.1",
    "turndown": "^7.2.2"
  },
  "devDependencies": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

Using a caret range for the runtime dependency turndown permits unreviewed upstream updates, increasing supply-chain risk if a compromised or vulnerable release is published. Because this skill converts retrieved documentation content into Markdown, the dependency operates on untrusted input and therefore has direct security relevance.

Content

Scanner excerpt · package.json (reported line 34)May include surrounding context.

json

"description": "Real-time search of the latest official OpenClaw docs with compact Markdown output for safer config, CLI, gateway, channels, and skills workflows.",
  "dependencies": {
    "jsdom": "^29.0.1",
    "turndown": "^7.2.2"
  },
  "devDependencies": {
    "@types/jsdom": "^28.0.1",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 37)May include surrounding context.

json

"turndown": "^7.2.2"
  },
  "devDependencies": {
    "@types/jsdom": "^28.0.1",
    "@types/turndown": "^5.0.6",
    "tsx": "^4.19.3",
    "typescript": "^5.8.2"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 38)May include surrounding context.

json

},
  "devDependencies": {
    "@types/jsdom": "^28.0.1",
    "@types/turndown": "^5.0.6",
    "tsx": "^4.19.3",
    "typescript": "^5.8.2"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 39)May include surrounding context.

json

"devDependencies": {
    "@types/jsdom": "^28.0.1",
    "@types/turndown": "^5.0.6",
    "tsx": "^4.19.3",
    "typescript": "^5.8.2"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 40)May include surrounding context.

json

"@types/jsdom": "^28.0.1",
    "@types/turndown": "^5.0.6",
    "tsx": "^4.19.3",
    "typescript": "^5.8.2"
  }
}

Static analysis

No suspicious patterns detected.