Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward web-search wrapper that sends search queries to a disclosed external search service, with privacy caveats users should understand.
Install only if you are comfortable sending search terms, image queries, news topics, and autocomplete text to claw-search.com and possibly its upstream search provider. Do not use it for secrets, credentials, private internal names, regulated personal data, or confidential investigations unless that external disclosure is acceptable.
The skill documents external search endpoints but does not warn users that their search queries will be transmitted to www.claw-search.com and potentially to upstream providers such as DuckDuckGo. This creates a privacy and data-handling risk because agents may forward sensitive user input, internal context, or confidential terms to third parties without informed consent.
The activation guidance is broad enough to trigger whenever an agent 'needs to search the web, find images, or get latest news,' which can cause the skill to be invoked in many situations without clear user intent or data-sensitivity checks. In this skill, that broad invocation is more concerning because it sends user queries to an external third-party service, increasing the chance of unnecessary data disclosure.
The function sends user-supplied search terms to an external third-party service over the network without any built-in disclosure, consent, or data-handling notice. In an agent skill context, users may reasonably assume local processing, so sensitive prompts, names, credentials, or internal project terms could be unintentionally disclosed to the external provider.
Image search forwards the user's query to an external API without any user-facing indication that partial or full search content leaves the local environment. In agent workflows, image queries can still contain sensitive personal, medical, corporate, or investigative terms, creating a privacy and data-sharing risk.
The news search function transmits user queries to a remote service with no explicit notice, which can expose user interests, internal topics, or sensitive investigations to the third party. Because this skill is designed as a convenience wrapper for agents, the hidden network boundary makes accidental disclosure more likely.
Suggestion requests are especially privacy-sensitive because they may transmit partial user input before the user has finalized or reviewed it. This can leak incomplete prompts, names, secrets, or intent signals to the external endpoint without meaningful user awareness.
The README instructs agents to send arbitrary user search queries to a third-party external API, but it does not warn that those queries leave the local/system context and may contain sensitive user data. In an agent setting, users may assume searches are handled by a trusted built-in tool, so the missing disclosure increases the risk of inadvertent privacy leakage to the external service.
No suspicious patterns detected.
