ClawHub
Back to skill

Security audit

Cn Web Search 2.0.0

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Chinese web-search helper that sends user-chosen search queries to listed external search engines.

Install only if you are comfortable with your search terms being sent to the listed search engines and APIs. Avoid using it for secrets, private identifiers, confidential business topics, or regulated personal data unless you have reviewed those providers' policies.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The example trigger phrases are generic, natural-language search requests such as '搜一下半导体产业链', which can overlap with ordinary user conversation and cause this skill to activate unexpectedly. In an agent ecosystem, overly broad activation can hijack unrelated requests, route queries to external search providers without clear user intent, and expand data exposure or tool-use beyond what the user expected.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill encourages sending arbitrary user queries to many third-party search engines and at least one API, but does not warn users that their search terms will be transmitted externally. This creates a real privacy risk because users may submit sensitive topics, identifiers, or proprietary information, which would then be disclosed to external services outside the host system's control.

External Transmission

Medium
Category
Data Exfiltration
Content
### 7.1 DDG Instant Answer API 🆕

```
https://api.duckduckgo.com/?q=QUERY&format=json&no_html=1
```

返回 JSON 格式的即时答案（定义、摘要、相关主题），适合快速获取事实性信息。
Confidence
91% confidence
Finding
This endpoint sends the user's query to DuckDuckGo's external API, which constitutes outbound data transmission to a third party. In a search skill this is expected behavior, but it is still security-relevant because sensitive user input could be exposed to an external provider if the user is not clearly informed and the query is not constrained.

External Transmission

Medium
Category
Data Exfiltration
Content
web_fetch(url="https://www.jisilu.cn/explore/?keyword=可转债", extractMode="text", maxChars=8000)

# 即时答案（JSON）
web_fetch(url="https://api.duckduckgo.com/?q=Python&format=json&no_html=1", extractMode="text", maxChars=5000)
```

---
Confidence
90% confidence
Finding
The example explicitly demonstrates transmitting a user query to DuckDuckGo's API via web_fetch, reinforcing that the skill operationally sends user data off-platform. The danger is contextual rather than malicious: users may copy these examples without realizing their queries can be logged or processed by external services.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The skill title and usage examples are entirely in Chinese and present the interaction mode as Chinese-only, without indicating that users may choose another language or that the locale restriction is intentional. For an organizational language-policy check, this can be read as forcing a specific language without user opt-in.

Natural-Language Policy Violations

Low
Confidence
76% confidence
Finding
The manifest description presents the skill as a Chinese web search skill and emphasizes Chinese-language search behavior, but it does not state that this locale constraint is optional or user-selectable. Under the policy, forcing a specific language or locale without opt-in or clear justification can be a natural-language policy violation.

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
The description states the skill is for Chinese web search ("中文网页搜索"), which is a natural-language locale constraint. In this manifest text, there is no indication of user choice, opt-in, or explicit justification that the skill is intentionally region- or language-specific.

Static analysis

No suspicious patterns detected.