ClawHub
Back to skill

Security audit

heimaosearch

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Heimaohui search integration that sends the user's query and Heimaohui API credentials to its API, with no hidden code, persistence, or local access found.

Install only if you intend to use Heimaohui's search service and are comfortable sending your Heimaohui account identifier, API key, and search text to api.heimaohui.com. Avoid entering sensitive client, personal, or confidential event details unless that sharing is acceptable under your own policies, and rotate the API key if you later uninstall or suspect exposure.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

文档明确要求把 account、open_api_key 和用户输入一并提交到第三方接口，但没有任何隐私提示、敏感信息最小化原则、传输告知或用户同意机制。这样会导致用户内容和长期有效凭据被外部服务处理，一旦误传敏感数据、日志留存或第三方被攻破，影响将超出当前对话范围。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

技能描述为“与公关、活动有关的内容都可以使用”，范围非常宽泛，容易覆盖普通咨询、写作建议或一般信息检索场景，导致代理在不必要时触发外部工具。误触发会把用户查询发送到第三方服务，增加隐私泄露、越权调用和结果被外部系统影响的风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

“当用户想查询以下内容时，必须使用该工具”采用强制触发策略，但没有边界说明、置信度门槛或替代路径，容易在语义相近但不需要外部搜索的请求中误调用。由于该工具会连同用户输入和凭据一起发送给外部接口，这种刚性策略会放大数据外传和错误操作的风险。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

该技能设计上会把用户输入发送到外部域名 api.heimaohui.com，属于明确的对外数据传输行为。结合上下文看，这不仅发送查询内容，还伴随账号和 API Key，因此外传的敏感性高于普通搜索类技能，若无约束会造成隐私与凭据暴露面扩大。

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
2. 将 account 和 open_api_key 一起提交
3. 调用接口：

POST https://api.heimaohui.com/index/search/recommendOpenClaw

请求参数：

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.json (reported line 23)May include surrounding context.

json
"name": "search_heimao",
      "description": "搜索活动策划、方案、资源及案例",
      "method": "POST",
      "url": "https://api.heimaohui.com/index/search/recommendOpenClaw",
      "headers": {
        "Content-Type": "application/json"
      },

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill sends the user's account identifier and API key to an external service, but the manifest does not provide a clear user-facing warning that credentials will be transmitted off-platform on invocation. This creates a meaningful risk of users supplying sensitive credentials without informed consent, and any downstream compromise or misuse of the third-party endpoint could expose those secrets.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This manifest description explains what the skill does but does not define when it should be invoked, what user requests should trigger it, or any exclusions. For manifest files, missing specificity on trigger scope can cause the skill to be selected for overly broad search-related requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The user-facing description and input descriptions are written only in Chinese, which can impose a language constraint without user opt-in. Under the language/locale policy, skills should not force a specific language unless the limitation is explicitly justified or the user is given a choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.