Skills/ClawHub/anysearch

anysearch@3.1.1

CAUTION· install only

Publisher claims: "Real-time search engine supporting web search, vertical domain search, parallel batch search, and URL content extraction." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher anysearch-ai · publishing for 110 daysInstalls 37,882Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: README links to an external installer; Persistence: instructs the agent to auto-load this skill in future sessions; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
README links to an external installerREADME.md → https://github.com/anysearch-ai/anysearch-skill/archive/refs/tags/v3.1.1.ziphttps://github.com/anysearch-ai/anysearch-skill/archive/refs/tags/v3.1.1.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Persistence: instructs the agent to auto-load this skill in future sessionsSKILL.md:99 · Persistence: instructs the agent to auto-load this skill in future sessionsAll bundled CLIs automatically load `.env` from the skill directory at startup (if present). The `.env` file format:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsSKILL.md:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesstorage: ".env file, environment variable, or --api_key CLI flag"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesAll bundled CLIs automatically load `.env` from the skill directory at startup (if present). The `.env` file format:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| **Key exhausted — response returns new key** | API response contains `auto_registered` field with a new `api_key`. Agent MUST: (1) extract the key, (2) ask the user for explicit confirmation before Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/anysearch_cli.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesUse utf-8-sig so .env files saved by Windows Notepad with a BOM are parsedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/anysearch_cli.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files--api_key > .env file > environment variable > anonymous.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_cli.py:216 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/anysearch_cli.js:427 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(output.join("\n"));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsscripts/anysearch_cli.sh:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor env_path in "$SCRIPT_DIR/.env" "$SCRIPT_DIR/../.env"; doFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/anysearch_cli.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescorrectly. The .env value intentionally overrides an existing environmentFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:94 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files--api_key CLI flag > .env file (ANYSEARCH_API_KEY) > system environment variable > anonymous accessFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/anysearch_cli.js:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPaths = [path.join(__dirname, ".env"), path.join(__dirname, "..", ".env")];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/anysearch_cli.js:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Skip empty values so an empty .env entry does not clobber a realFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/anysearch_cli.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor env_path in [os.path.join(script_dir, ".env"), os.path.join(script_dir, "..", ".env")]:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandscripts/anysearch_cli.sh:523 · Process kill command — agent can terminate processes[[ ${#pids[@]} -gt 0 ]] && kill "${pids[@]}" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/anysearch_cli.sh:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Skip empty values so an empty .env entry does not clobber a realFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/anysearch_cli.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load API keys from .env files near the skill.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈3,154 tok
1 file · 20 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim anysearch-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim anysearch-aiPropose a patch to the maintainer