ClawHub

Openclaw Ask Search

Security checks across malware telemetry and agentic risk

Overview

The core search tool is straightforward, but its README gives under-scoped instructions for proxying and browser-based fetching to get around site blocks.

Review the README before installing. The core SearxNG search wrapper appears coherent, but avoid using the proxy, headless browser, logged-in browser, or delegated local-agent workflows unless you have authorization and understand the site-policy, account, and privacy risks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README explicitly instructs users to use residential SOCKS proxies, archive caches, and headless browsers to access sites that are blocking direct requests, but it does not include meaningful warnings about privacy, account, legal, or terms-of-service risks. In an agent skill context, this guidance can normalize or automate access-control circumvention and increase the chance that users deploy risky scraping workflows without informed consent.

Ssd 4

Medium
Confidence
98% confidence
Finding
The narrative workflow goes beyond ordinary search and gives step-by-step instructions for overcoming blocking controls via residential proxies, local logged-in browsers, and multi-node delegation. In a tool intended for AI agents, this materially lowers the barrier to evasive scraping behavior and could be used to bypass website protections or shift restricted fetching to a more trusted environment.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal