ClawHub
Back to skill

Security audit

globalsearch

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed web-search skill that sends search queries to an external provider using a user-supplied API key.

Install only if you are comfortable sending search terms to clb.ciglobal.cn and associating usage with its API key account. Avoid using it for passwords, tokens, private identifiers, confidential internal data, or sensitive personal searches unless you have verified the provider's privacy and retention practices.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
Body (form): keyword=机器学习&mode=warehouse&page=1
```

### Example 4: cURL
```bash
curl -X POST "https://clb.ciglobal.cn/web_search" \
  -H "X-API-Key: <your_api_key>" \
Confidence
92% confidence
Finding
This skill is explicitly designed to transmit user search queries to an external third-party endpoint, which creates a real data-exposure risk if queries contain sensitive, personal, or internal information. The context makes this behavior expected, but still security-relevant because the provider is external and the document itself notes that its trustworthiness and retention practices should be verified.

Static analysis

No suspicious patterns detected.