ClawHub
Back to skill

Security audit

bailian-web-search

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a web-search helper, but it asks for broad file and command access without clear limits.

Review this before installing. It is not evidence of malware, but it gives the agent broad local file and shell capabilities for a task that is described mainly as web search. Prefer installing only in a sandbox or with exec/write disabled, use a limited API key, and avoid sending sensitive search terms or private files through the skill.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill is presented as a web-search capability, but the documentation expands into unrelated high-privilege behaviors such as scheduled sync, chart generation, and broader data-processing workflows. This scope creep weakens operator understanding of what the skill may do and can justify unnecessary tool access, increasing the chance of misuse or over-privileged execution.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
Documenting file read/write and system command execution for a web-search skill introduces unnecessary high-risk capabilities unrelated to the stated purpose. In an agent setting, broad exec and filesystem access can be abused through prompt injection, misrouting, or operator confusion to run commands or access local data far beyond search.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The documentation claims that only whitelisted commands are executed, but it provides no enforceable whitelist or scoped command behavior while the manifest broadly enables exec tooling. This creates a dangerous mismatch between perceived and actual controls, which may cause users or orchestrators to trust the skill with permissions that are not meaningfully constrained.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The invocation guidance is overly broad, encouraging use across general AI model calling, agent orchestration, and LLM applications rather than narrowly defined web-search tasks. In agent ecosystems, vague trigger criteria increase the likelihood that the skill is invoked in inappropriate contexts where its permissions and external connectivity may be unnecessary or risky.

Static analysis

No suspicious patterns detected.