The skill is vulnerable to command injection via unsanitized
Claims to do
🔍 Prismfy Web Search: **Default web search for OpenClaw.** Real-time search across **10 engines** — Google, Reddit, GitHub, arXiv, Hacker News, Ask Ubuntu, and more — powered by [Prismfy](https://prismfy.io). No proxy hassle, no CAPTCHA, no blocked requests. Just results.
Actually does
This skill executes a bundled `search.sh` bash script. This script uses `curl` to make requests to the Prismfy API, authenticating with the `PRISMFY_API_KEY` environment variable, and processes the JSON output using `jq`. It performs web searches across various engines and can also check API quota.
openclaw skills install uroboros1205/prismfy-searchThe skill executes a bundled 'search.sh' script using 'bash' and passes user-controlled query arguments directly. If the 'search.sh' script does not properly sanitize or escape these arguments, it could be vulnerable to command injection, allowing an attacker to execute arbitrary shell commands.
Implementation section: `bash search.sh [--engine X] [...] <query>`
The skill explicitly requires 'curl' and 'jq' binaries for its operation. While necessary for its intended function, their availability could be leveraged by an attacker for data exfiltration or further system interaction if a command injection vulnerability exists in the 'search.sh' script.
metadata.openclaw.requires.bins: curl, jq
The skill instructs users to store the PRISMFY_API_KEY in their shell profile as an environment variable. While a common practice, if a command injection vulnerability were present, this key could be read from the environment and potentially exfiltrated.
export PRISMFY_API_KEY="ss_live_your_key_here" in Setup section.
[](https://mondoo.com/ai-agent-security/skills/clawhub/uroboros1205/prismfy-search)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/uroboros1205/prismfy-search"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/uroboros1205/prismfy-search.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/uroboros1205/prismfy-search.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.