ClawHub
Back to skill

Security audit

sn-search-social-en

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward social-search helper that discloses its API-key use and external requests, with only minor packaging and scoping notes.

Install this only if you are comfortable running local Python scripts that send search queries to Reddit, TikHub, and Google/YouTube. Use limited-scope API keys where possible, avoid passing secrets on shared shell histories, and consider pinning httpx before operational use.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs users to run local Python scripts that read credentials from environment variables and make outbound network requests, but the skill declares no corresponding permissions or capability disclosures. This creates a transparency and governance gap: an agent or user may invoke code with access to secrets and external services without an explicit permission model, increasing the risk of unintended credential exposure or unauthorized network use.

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.27
Confidence
89% confidence
Finding
The dependency is specified with a lower-bound only version constraint (`httpx>=0.27`), which allows future unreviewed releases to be installed. This can introduce supply-chain risk, unexpected breaking changes, or newly introduced vulnerabilities without the maintainer explicitly approving the version. In a network-facing skill that likely performs external HTTP requests, dependency behavior changes can directly affect request handling and security posture.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.