ClawHub
Back to skill

Security audit

Swiss Phone Directory

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward search.ch Swiss phone-directory lookup skill with disclosed API key and network use, but users should be careful with personal contact data and persistent API-key storage.

Install only if you are comfortable sending lookup terms, locations, phone numbers, and your search.ch API key to search.ch. Avoid storing the API key in shell profile files on shared or heavily automated systems; use per-session environment variables, a gateway secret, or a secrets manager when possible. Treat returned names, addresses, emails, and websites as untrusted display data, especially if shown in Markdown-capable clients.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
searchch.py:144
Finding

Unsanitized Remote Directory Data Allows Terminal and Markdown Output Injection

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · configuration.md (reported line 23)May include surrounding context.

ored in the SEARCHCH_API_KEY environment variable.

Get an API Key

  1. Visit https://search.ch/tel/api/getkey.en.html
  2. Fill out the request form
  3. Receive your API key via email

Set the Environment Variable

Temporary (current session):

bash
export SEARCHCH_API_KEY="your-api-key-here"

Permanent (add to shell profile):

bash
# For bash (~/.bashrc or ~/.bash_profile)
echo 'export SEARCHCH_API_KEY="your-api-key-here"' >> ~/.bashrc
source ~/.bashrc

# For zsh (~/.zshrc)
echo 'export SEARCHCH_API_KEY="your-api-key-here"' >> ~/.zshrc
source ~/.zshrc

For Clawdbot Gateway:

Add to your gateway config or environment:

yaml
env:
  SEARCHCH_API_KEY: "your-api-key-here"

API Limits

  • Without API key: Limited queries, no structured data
  • With API key: More queries per day, full structured data (Atom feed)
  • Maximum results per query: 200

Troubleshooting

"Invalid API key" error

  • Verify the key is correctly set: echo $SEARCHCH_API_KEY

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · searchch.py (reported line 25)May include surrounding context.

python
def get_api_key() -> str:
    """Get API key from environment variable."""
    key = os.environ.get("SEARCHCH_API_KEY")
    if not key:
        print("❌ Error: SEARCHCH_API_KEY environment variable not set", file=sys.stderr)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill requires environment access for an API key and network access to query an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. In agent environments, missing scope declarations can cause over-broad execution privileges, reduce auditability, and make it harder to constrain or review what the skill is allowed to access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is explicitly designed for person lookup and reverse phone number lookup, which can expose personal contact details and facilitate profiling or harassment if used without notice or safeguards. The context makes this more sensitive, not less, because the primary purpose includes searching individuals rather than only public business records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation recommends persisting an API key in shell profile files such as ~/.bashrc and ~/.zshrc without warning that these files may be broadly readable to local tools, accidentally committed, backed up, or exposed through support/debug workflows. This is not malware, but it does encourage long-lived credential storage in a less controlled location, increasing the chance of credential disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file performs an HTTP request to a third-party service using user-provided query and location values, but there is no confirmation prompt or user-facing disclosure at the point of transmission. Although network access is inherent to an API wrapper, the code does not visibly warn users that their inputs are being sent off-system, which matters because phone-directory lookups can contain personal data such as names, addresses, or phone numbers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The search function sets lang to de by default, and the CLI mirrors that default, which means the tool forces a specific language unless the user notices and overrides it. The policy criteria call out locale or language defaults as violations when a specific language is imposed without explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The printed status messages Keine Treffer gefunden and Treffer are always shown in German regardless of user preference. This is a natural-language policy issue because the interface language is fixed rather than selected by the user or tied to a documented, justified locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.