Openclaw Free Search

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward web-search helper that sends search terms to DuckDuckGo and may use curl as a fallback, with no evidence of credential access, persistence, or destructive behavior.

Install only if you are comfortable with your search terms being sent to DuckDuckGo. Do not search for passwords, API keys, private project names, customer data, or other sensitive information through this skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation exposes and instructs use of a Node.js script that performs web search, which implies network access and shell execution, yet no permissions are declared. This creates a transparency and consent problem: users and host systems may not realize the skill can send data externally and invoke executable code, increasing the chance of unreviewed outbound requests or unsafe execution in restricted environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises free web search but does not warn that entered search queries will be sent to an external third-party service. Users may submit sensitive prompts, internal project names, credentials, or personal data under the assumption the action is local, causing unintended data disclosure to an outside provider.

VirusTotal

65/65 vendors flagged this skill as clean.