ClawHub

Zhipu Search

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Zhipu web-search skill that sends search requests to Zhipu using a configured API key, with no hidden persistence or unrelated system access found.

Install only if you are comfortable sending search queries to Zhipu AI. Use a dedicated Zhipu API key where possible, avoid sensitive private queries, and do not pass real names, emails, or account IDs as user_id values.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents an optional `user_id` parameter that is sent to an external third-party API but does not disclose the privacy implication that an end-user identifier will leave the local system. This can cause unintended transmission of personal or correlatable identifiers to Zhipu, creating privacy, compliance, and user-consent risks.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script sends the user's search query and optional user_id to an external third-party API without any explicit disclosure, consent prompt, or privacy warning at execution time. In an agent skill context, users may assume local processing, so silent transmission of potentially sensitive queries or identifiers can create privacy, compliance, and data-handling risks.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal