ClawHub
Back to skill

Security audit

Multi-Engine Web Search

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real web search helper, but it should be reviewed because it can silently run a Tavily script from a neighboring package outside its own reviewed files.

Install only if you are comfortable with your search queries going to external search providers and with the skill reading a Tavily API key from your environment or ~/.openclaw/.env. Review or remove the automatic sibling-package Tavily execution path before using it in a sensitive environment, because a compromised neighboring package could run code with the agent's permissions.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/web_search.py:64
Finding

Untrusted Out-of-Package Script Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (14)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/engines.md (reported line 24)May include surrounding context.

Environment variable

export TAVILY_API_KEY="tvly-xxxx"

Or in ~/.openclaw/.env

TAVILY_API_KEY=tvly-xxxx

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/web_search.py (reported line 44)May include surrounding context.

python
return key

    # Check config file
    config_path = os.path.expanduser("~/.openclaw/.env")
    if os.path.exists(config_path):
        with open(config_path, "r") as f:
            for line in f:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/web_search.py (reported line 60)May include surrounding context.

python
return key

    # Check config file
    config_path = os.path.expanduser("~/.openclaw/.env")
    if os.path.exists(config_path):
        with open(config_path, "r") as f:
            for line in f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents execution of a Python script, use of environment variables, browser/network access, and file-based configuration, but it does not declare any explicit tool scope or permissions boundary. This can lead to over-broad agent authority at runtime, making it easier for the skill to access shell, network, or local resources beyond what a user would reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad, common phrases like "search", "look up", and equivalents in Chinese, which can cause the skill to activate in contexts where the user did not intend external web access. In this skill, unintended invocation is more dangerous because activation can result in network requests, browser automation, and possible transmission of sensitive query text to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages sending user queries to Tavily, Google, Bing, Baidu, DuckDuckGo, and browser automation without clearly warning that query contents may be disclosed to external providers. In a search skill, this omission materially increases privacy risk because users may include proprietary, personal, or regulated information in search terms without realizing it leaves the local environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/web_search.py (reported line 85)May include surrounding context.

python
cmd.append("--include-answer")

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            data = json.loads(result.stdout)
            data["engine"] = "tavily"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/web_search.py (reported line 111)May include surrounding context.

python
try:
        import requests

        url = "https://api.tavily.com/search"
        payload = {
            "api_key": api_key,
            "query": query,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/web_search.py (reported line 119)May include surrounding context.

python
"include_answer": include_answer,
        }

        response = requests.post(url, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/web_search.py (reported line 176)May include surrounding context.

python
try:
        # Use agent-browser to open and snapshot the search results
        # Open the search URL
        open_result = subprocess.run(
            ["agent-browser", "open", url],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/web_search.py (reported line 192)May include surrounding context.

python
}

        # Wait for page to load
        subprocess.run(
            ["agent-browser", "wait", "2000"],
            capture_output=True,
            timeout=10,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/web_search.py (reported line 199)May include surrounding context.

python
)

        # Get snapshot with interactive elements
        snapshot_result = subprocess.run(
            ["agent-browser", "snapshot", "-i", "--json"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/web_search.py (reported line 218)May include surrounding context.

python
results = parse_search_results(engine, snapshot_result.stdout, max_results)

        # Close browser
        subprocess.run(["agent-browser", "close"], capture_output=True, timeout=10)

        return {
            "query": query,

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest describes a web search skill and does mention Tavily API support, so network search behavior is expected. However, this implementation also reads secrets from both process environment and a user-local config file, which is a broader credential-access capability than ordinary search execution and is not explicitly stated in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.