ClawHub
Back to skill

Security audit

sn-search-code

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward developer-search tool that calls public search APIs and does not show hidden persistence, destructive behavior, or unrelated data access.

Before installing, consider pinning or constraining the httpx dependency in your own environment. Use least-privilege GitHub or HuggingFace tokens when needed, preferably via environment variables, and avoid supplying broad personal tokens on the command line.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.27
Confidence
92% confidence
Finding
The dependency is specified with only a lower bound (`httpx>=0.27`), which allows future unreviewed versions to be installed. This can introduce supply-chain risk, unexpected breaking changes, or newly introduced vulnerable behavior during future installs, especially in an agent skill that performs network-related functionality.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.