Security audit

Claw Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is a search service, but its bundled server code can let unauthenticated users run commands, browse internal network URLs, and view shared search history.

Do not run this as a public or trusted service until it is patched. At minimum, replace shell-based search execution with argument-based process calls, remove or strictly validate arbitrary URL extraction, remove public shared history, sanitize frontend rendering, disclose query transmission and retention, regenerate dependencies from HTTPS sources, and test only in an isolated environment with no secrets or internal-network access.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: server/search.js:13
Finding: Unauthenticated Remote Command Injection Through Search Query
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server-v2.js:226
Finding: Unrestricted Server-Side Request Forgery in Content Extraction Endpoint
Content: View full analysis
{ const remove = ['script', 'style', 'nav', 'footer', 'header', 'aside', 'iframe', 'noscript', '.ad', '.comment']; remove.forEach(sel => { try { document.querySelectorAll(sel).forEach(el => el.remove()); } catch(e) {} }); const article = document.querySelector('article') || document.querySelector('main') || document.querySelector('.content') || document.body; const title = document.querySelector('h1')?.textContent?.trim() || document.title; const paragraphs = article?.querySelectorAll('p') || []; const text = Array.from(paragraphs).map(p => p.textContent?.trim()).filter(t => t && t.length > 30).slice(0, 15).join('\n\n'); return { title, content: text }; }); return content; } catch (e) { return { error: e.message }; } finally { if (browser) await browserPool.release(browser); } } ``` ```javascript if (url === '/api/extract' && req.method === 'POST') { let body = ''; req.on('data', chunk => body += chunk); req.on('end', async () => { try { const data = JSON.parse(body); if (!data.url) throw new Error('url is required'); const content = await extractContent(data.url); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ url: data.url, ...content })); ``` ### Technical Analysis The unauthenticated `/api/extract` endpoint accepts an arbitrary URL and directs a server-side Chro ...[truncated 1981 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: public/index.html:482
Finding: DOM-Based Cross-Site Scripting Through Unescaped Search Results
Content: View full analysis
0) { html += '
'; html += '
🆓 免费API推荐
'; data.freeApis.forEach(api => { html += `
${api.name}
${api.description}

`; }); html += '
'; } // 显示搜索结果 if (data.results && data.results.length > 0) { html += '
🔍 网页搜索结果
'; data.results.forEach(r => { html += `
${r.title}
${r.description || ''}

🔗 ${r.url.substring(0,60)}...

`; }); } else if (!data.freeApis || data.freeApis.length === 0) { html += '
未找到结果
'; } resultsDiv.innerHTML = html; ``` ### Technical Analysis Search-result titles, descriptions, URLs, and API metadata are concatenated into an HTML string and assigned to `innerHTML`. These values originate from external search engines and third-party web pages and are not esc ...[truncated 1967 chars]
Remediation: View remediation

other

Warning

Location: server-v2.js:360
Finding: Unauthenticated Disclosure of Shared User Search History
Content: View full analysis
-1) this.data.splice(idx, 1); this.data.unshift(query); if (this.data.length > this.maxSize) this.data.pop(); }, getRecent(count = 10) { return this.data.slice(0, count); }, getSuggestions(prefix) { if (!prefix || prefix.length < 2) return []; return this.data.filter(q => q.toLowerCase().includes(prefix.toLowerCase())).slice(0, 5); } }; ``` ```javascript if (url === '/api/history' && req.method === 'GET') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ history: searchHistory.getRecent(20) })); return; } ``` ```javascript // 记录历史 searchHistory.add(query); ``` ### Technical Analysis Every submitted search query is added to a single global in-memory history shared by all users. The latest 20 entries are returned through an unauthenticated `/api/history` endpoint. The suggestion endpoint can also reveal matching historical terms based on a supplied prefix. Search queries may contain confidential topics, personal identifiers, internal project names, URLs, or accidentally pasted credentials. The implementation does not obtain consent, isolate records by user, enforce authorization, or redact sensitive content. This behavior also conflicts with the project's claim in `UNFLAG_REQUEST.md` that search data is not stored. ### Attack Path 1. Users submit search queries to the public search API. 2. Each query is added to the process-wide `searchHistory.data` array. 3. An attacker calls `GET /api/history` without authentication. 4. The service returns up to 20 recent queries submitted by other users. 5. The attacker polls the endpoint repeatedly to monitor new searches. 6. ...[truncated 680 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package-lock.json:15
Finding: Dependency Lockfile Uses Plaintext HTTP Package Sources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (54)

Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

High

Category: Supply Chain
Confidence: 92% confidence
Finding: basic-ftp 5.2.0 is flagged with command-injection and denial-of-service advisories. In this lockfile it appears as a transitive dependency via get-uri/proxy handling rather than an explicitly chosen package, so exploitation depends on whether the application actually processes attacker-controlled FTP or proxy URIs, but the vulnerable code is present in the dependency graph.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: extract-zip 2.0.1 is associated with arbitrary file write and symlink traversal issues during archive extraction. Since Puppeteer’s browser-management stack uses archive download/extraction, a malicious or tampered browser archive could potentially write outside the intended directory and compromise the host environment.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: ip-address 10.1.0 has reported issues involving parsing inconsistencies and XSS in HTML-emitting methods. In this dependency graph it is transitively used by SOCKS/proxy components, so the practical risk is limited unless the application exposes these parsing results or HTML-rendering methods to attacker-controlled input.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: js-yaml 4.1.1 is flagged for CPU-exhaustion issues when parsing malicious YAML constructs. As a transitive dependency of cosmiconfig used by Puppeteer, it becomes relevant if the application loads attacker-influenced configuration files or scans untrusted directories for config.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

Category: Supply Chain
Confidence: 93% confidence
Finding: path-to-regexp 8.3.0 is reported vulnerable to ReDoS/DoS patterns, and it is used by router/express to compile route definitions. If the application defines complex vulnerable route patterns or allows dynamic route creation, attackers may be able to trigger excessive CPU consumption via crafted paths against a network-exposed Express service.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: ws 8.19.0 is flagged for memory disclosure and memory exhaustion issues. Because ws is used by puppeteer-core for browser protocol communication, risk is highest when the skill connects to untrusted WebSocket endpoints or exposes browser-automation channels across trust boundaries.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · public/index.html (reported line 241)May include surrounding context.
html
<button onclick="doSearch()" data-i18n="search">搜索</button> </div>  <div id="searchResults" style="max-width: 700px; margin: 20px auto; text-align: left;"></div> <div class="api-demo">

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code builds a shell command with unsanitized user-controlled input via execSync(skillhub search "${query}"). Quoting with double quotes is not sufficient to prevent shell metacharacter expansion or command substitution, so an attacker may execute arbitrary local commands under the server's privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs users or agents to send search queries to a third-party remote API, but it does not warn that prompts, keywords, or potentially sensitive user data will leave the local environment. In an agent context, search terms may contain proprietary, personal, or operationally sensitive information, so undisclosed external transmission creates a real privacy and data-governance risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The hardcoded remote endpoint indicates reliance on an external hosted service rather than a purely local capability. This increases exposure because agents may automatically contact the remote domain and disclose operational metadata or search content without an explicit trust decision by the user.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
Web 搜索

bash
curl -X POST https://api.claw-search.com/api/search \ -H "Content-Type: application/json" \ -d '{"query": "openclaw ai agent", "count": 10}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The hardcoded remote endpoint indicates reliance on an external hosted service rather than a purely local capability. This increases exposure because agents may automatically contact the remote domain and disclose operational metadata or search content without an explicit trust decision by the user.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
Web 搜索

bash
curl -X POST https://api.claw-search.com/api/search \ -H "Content-Type: application/json" \ -d '{"query": "openclaw ai agent", "count": 10}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
docker-compose up -d

测试

curl https://api.claw-search.com/health

text
### 手动部署

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · public/index.html (reported line 246)May include surrounding context.
html
docker-compose up -d # 测试 curl https://api.claw-search.com/health ``` ### 手动部署

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · public/index.html (reported line 521)May include surrounding context.
html
docker-compose up -d # 测试 curl https://api.claw-search.com/health ``` ### 手动部署

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description advertises web search and URL content extraction but does not clearly warn users that queries and fetched URLs will be transmitted to external services over the network. For an agent skill, this omission can cause users or downstream agents to unknowingly send sensitive prompts, internal URLs, or proprietary data to third parties, creating privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JSON file contains multiple natural-language fields in Chinese, including descriptions and tags, while other fields remain in English. Because the file does not document that the skill is intentionally Chinese-language or offer any locale choice, it effectively imposes a language preference without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The lockfile pins package tarball downloads to plain HTTP mirror URLs, which permits man-in-the-middle tampering of package contents during installation. While integrity hashes help detect some tampering, relying on insecure transport for dependency retrieval materially increases supply-chain risk and can enable build disruption or compromised installs if integrity checks are bypassed or alternate tooling ignores them.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · public/index.html (reported line 245)May include surrounding context.
html
<div id="searchResults" style="max-width: 700px; margin: 20px auto; text-align: left;"></div> <div class="api-demo"> <h3 data-i18n="curl_demo">cURL 示例</h3> <pre><span class="keyword">curl</span> -X POST https://api.claw-search.com/api/search \ -H <span class="string">"Content-Type: application/json"</span> \ -d '<span class="string">{"query": "openclaw ai agent", "count": 10}</span>'</pre>

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language strings describe automatic language switching based on IP, and the initialization logic defaults the experience based on detected locale rather than explicit user choice. This can violate language/locale policy because the skill applies a locale decision automatically instead of requiring opt-in, even though a manual selector exists.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The English translation explicitly states that language is auto-detected from IP, and the page initializes language based on detected locale instead of explicit user choice. This is a natural-language locale-policy concern because the skill imposes locale behavior automatically rather than making it opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The Japanese translation says the language is automatically detected from IP, which is locale-based behavior applied without explicit opt-in. That natural-language instruction conflicts with the requirement to avoid forcing or inferring language/locale unless the user chooses it or the constraint is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The Korean translation also states that language is detected based on IP, indicating automatic locale selection without user opt-in. This is a policy issue in natural-language content because locale behavior is imposed by inference rather than explicit selection.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This duplicate detection corresponds to the same fetch call that transmits search queries to the external API. The danger is contextual: the app is a search frontend, so off-site transmission is expected, but lack of user warning and possible sensitive queries make it a real privacy issue.
Content: Scanner excerpt · public/index.html (reported line 475)May include surrounding context.
html
const resultsDiv = document.getElementById('searchResults'); resultsDiv.innerHTML = '<div style="text-align:center;padding:20px;">🔍 搜索中...</div>'; fetch('https://api.claw-search.com/api/search', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ query: query, count: 5 })

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This duplicate detection corresponds to the same fetch call that transmits search queries to the external API. The danger is contextual: the app is a search frontend, so off-site transmission is expected, but lack of user warning and possible sensitive queries make it a real privacy issue.
Content: Scanner excerpt · public/index.html (reported line 475)May include surrounding context.
html
const resultsDiv = document.getElementById('searchResults'); resultsDiv.innerHTML = '<div style="text-align:center;padding:20px;">🔍 搜索中...</div>'; fetch('https://api.claw-search.com/api/search', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ query: query, count: 5 })

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: User-entered search terms are transmitted to a third-party API endpoint without any visible privacy notice, consent prompt, or data-use disclosure. Search queries can contain sensitive personal, business, or authentication-related information, so silent transmission creates a real privacy risk even if the transport is HTTPS.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: server/search.js:16

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/search.mjs:7

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: server/search.js:8

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

🆓 免费API推荐

🔍 网页搜索结果

other

T08 · Insecure Dependencies

SkillSpector

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

Hidden Instructions

Context-Inappropriate Capability

Missing User Warnings

External Transmission

Web 搜索

External Transmission

Web 搜索

External Transmission

测试

External Transmission

External Transmission

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

External Transmission

External Transmission

Missing User Warnings

Static analysis

Shell command execution detected (child_process).

Environment variable access combined with network send.

Environment variable access combined with network send.