ClawHub
Back to skill

Security audit

Querit API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Querit.ai API integration helper that sends user-selected search queries or URLs to Querit using a provided API key.

Install only if you intend to integrate with Querit.ai and are comfortable sending selected queries or URLs to Querit's API. Store QUERIT_API_KEY as a secret, avoid logging it, and pin/review the `querit` SDK version before using the documented Python package in production.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/python-integration.md:6
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: references/python-integration.md:6
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash
pip install querit   # GitHub: querit-ai/querit-python

Technical Analysis

The integration guide instructs users to install the querit package without pinning a reviewed version or verifying package hashes. Consequently, the installed artifact is determined by the package index at installation time and may differ from the version reviewed when this Skill was published.

Python package installation can execute package-controlled build or installation logic. If the package publisher account, distribution channel, or a future release is compromised, following this command could introduce attacker-controlled code into the user's environment. The nearby reference to SDK version v0.1.4 does not constrain the installation command to that version.

This is a supply-chain exposure rather than evidence that the current querit package is malicious.

Attack Path

  1. An attacker compromises the package publisher account, release pipeline, or package distribution channel.
  2. The attacker publishes a malicious or backdoored release under the expected package name.
  3. A user follows the documented pip install querit command.
  4. Pip resolves and installs the mutable release without hash verification.
  5. Package-controlled code executes during installation or when the integration imports and uses the package.
  6. The malicious code operates with the privileges of the user or service running the installation or application.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the installing user or the application service account. Depending on that account's access, the compromise could expose application data, environment variables such as QUERIT_API_KEY, other credentials available to the process, and files writ ...[truncated 296 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specifically reviewed release, consistent with the documented SDK version:
bash
pip install "querit==0.1.4"
  1. Prefer a locked requirements file containing cryptographic hashes:
text
querit==0.1.4 \
    --hash=sha256:REPLACE_WITH_VERIFIED_DISTRIBUTION_HASH

Install it with hash enforcement:

bash
pip install --require-hashes -r requirements.txt

  1. Verify hashes against artifacts obtained from the official publisher and document the authoritative package-index and source-repository links.

  2. Review transitive dependencies and pin them through a generated lock file where applicable.

  3. Perform dependency upgrades through a controlled process that includes source review, vulnerability scanning, and integrity verification before changing the pinned version.

  4. Install and run the integration under a dedicated, least-privileged virtual environment or service account so a compromised dependency cannot access unrelated secrets or system resources.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares access to environment variables and relies on outbound network use, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where the runtime may permit broader execution than reviewers or users expect, increasing the risk of unintended secret access or external transmission during skill use.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/contents-api.md (reported line 118)May include surrounding context.

md
3. Use `content` only where the status is `success`. Anything else is a fetch failure, not a blank page.
4. Treat a requested URL that appears in neither array as a failure too.

Joining the arrays by index, or reading `content` without checking the status, records a failed crawl as an empty document. `python-integration.md` has a Python implementation of this join.

## curl reference

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/contents-api.md (reported line 120)May include surrounding context.

Joining the arrays by index, or reading content without checking the status, records a failed crawl as an empty document. python-integration.md has a Python implementation of this join.

curl reference

bash
curl -X POST "https://api.querit.ai/v1/contents" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/search-api.md (reported line 139)May include surrounding context.

  • Every field inside a result is optional and may be absent from a given entry, including url and title. Read them as optional rather than assuming presence.
  • After building a filters object by hand, run the query with and without it and compare the result sets. A filter that silently matched nothing looks exactly like a query with no good hits.

curl reference

bash
curl -X POST "https://api.querit.ai/v1/search" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/contents-api.md (reported line 8)May include surrounding context.

md
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/contents-api.md (reported line 123)May include surrounding context.

md
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/python-integration.md (reported line 67)May include surrounding context.

md
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/python-integration.md (reported line 68)May include surrounding context.

md
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/search-api.md (reported line 6)May include surrounding context.

md
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/search-api.md (reported line 142)May include surrounding context.

md
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/querit_smoke.py (reported line 28)May include surrounding context.

python
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/querit_smoke.py (reported line 29)May include surrounding context.

python
import urllib.error
import urllib.request

SEARCH_URL = "https://api.querit.ai/v1/search"
CONTENTS_URL = "https://api.querit.ai/v1/contents"
MAX_CONTENTS_URLS = 10

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The example request hard-codes languages: { "include": ["english"] }, which can encourage integrations to default to English-only behavior. Because the file does not frame this as a user-selected option or region-specific requirement in that example, it risks violating language/locale choice expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This is a markdown file, so SQP-2 applies to missing warnings in the skill description. The file instructs users to send a bearer token via Authorization and later references ${QUERIT_API_KEY}, but it does not warn users to keep the key secret or avoid exposing it in logs, shared snippets, or client-side contexts.

Content

No source excerpt is available for this finding.