ClawHub
Back to skill

Security audit

112131131313131

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Baidu search skill, with normal privacy and API-key handling cautions.

Install only if you are comfortable sending search terms to Baidu's API and providing a Baidu API key for this skill. Avoid queries containing secrets, personal data, or confidential project names, protect the OpenClaw config file with restrictive permissions, and rotate the key if it is exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to submit arbitrary search queries to Baidu's external API but does not clearly warn that those queries leave the local environment and are sent to a third party. This can expose sensitive prompts, internal project names, credentials pasted by mistake, or regulated data to an external service without informed user consent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The guide instructs users to place a long-lived API key in plaintext inside a local JSON config file and does not warn about file permissions, local compromise, backups, or accidental disclosure. While this is common operational guidance, it increases the chance that the credential is exposed through world-readable files, source control, support bundles, or shell/history workflows.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.