Cn Web Search 2.0.0

PassAudited by ClawScan on May 1, 2026.

Overview

This is an instruction-only web search skill with no code or credential use, but users should notice the package identity/version inconsistencies and that search queries are sent to third-party engines.

This skill appears safe for ordinary web searching and has no runnable code or credential requirements. Before installing, confirm the correct ClawHub slug/version because the artifacts disagree, and remember that whatever you search for may be sent to external search engines.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user could be confused about which package, slug, or version is the intended one.

Why it was flagged

The evaluated registry slug is listed as cn-web-search-2-0-0, while SKILL.md tells users to install cn-web-search; other artifacts also disagree on version/identity, creating a package provenance ambiguity.

Skill content

clawhub install cn-web-search

Recommendation

Verify the exact registry entry, slug, version, and repository before installing or recommending this skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search terms may be visible to the selected search engine, and HTTP queries may be visible or modifiable by network intermediaries.

Why it was flagged

The skill's normal operation sends user query terms in URLs to third-party search providers; the listed ArXiv endpoint also uses http:// rather than https://.

Skill content

web_fetch(url="https://www.baidu.com/s?wd=英伟达财报", extractMode="text", maxChars=12000)

Recommendation

Avoid searching for secrets or sensitive personal/business information, and prefer HTTPS endpoints/providers when possible.