anysearch is an AI agent skill, created by anysearch-ai and published at anysearch-ai/anysearch-skill. ClawSecure audited anysearch across 22 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (Critical). The 17 findings concentrate in Data Exfiltration, Code Injection and Unauthorized Tool Use, including Credential Harvesting via Network and Multi-File Data Exfiltration Chain. 4 were rated high or critical severity.
Is anysearch safe?
ClawSecure audited anysearch and assigned a security score of 0/100 (Critical), identifying 17 findings across Data Exfiltration and Code Injection. Review the findings below before installing.
What did ClawSecure find in anysearch?
ClawSecure identified 17 findings in anysearch, concentrated in Data Exfiltration, Code Injection and Unauthorized Tool Use. 4 were rated high or critical severity. The most severe include Credential Harvesting via Network and Multi-File Data Exfiltration Chain.
How was anysearch audited?
ClawSecure ran anysearch through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 22 files from anysearch-ai/anysearch-skill.
What does a score of 0 mean?
ClawSecure assigned anysearch a security score of 0/100, placing it in the Critical range. This is driven by 17 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for anysearch
ClawSecure detected 17 security findings in anysearch, spanning Data Exfiltration, Code Injection, Unauthorized Tool Use and Supply Chain Attack.
- critical · Credential Harvesting via Network. Data Exfiltration finding.
- critical · Multi-File Data Exfiltration Chain. Data Exfiltration finding.
- critical · Environment Variable Exfiltration via Network. Data Exfiltration finding detected in
scripts/anysearch_cli.py. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
SKILL.md. - medium · Undeclared Network Access. Unauthorized Tool Use finding detected in
SKILL.md. - medium · Dependency 'requests' has no pinned (==) version. Unpinned…. Supply Chain Attack finding detected in
requirements.txt:4. - medium · Suspicious Pattern: requests.request(. Data Exfiltration finding detected in
scripts/anysearch_cli.py:78. - medium · Variable $tpl (tainted at line 582:…. Data Exfiltration finding detected in
scripts/anysearch_cli.sh:582. - medium · Variable $tpl (tainted at line 583:…. Data Exfiltration finding detected in
scripts/anysearch_cli.sh:583. - medium · Variable $tpl (tainted at line 584:…. Data Exfiltration finding detected in
scripts/anysearch_cli.sh:584. - medium · Suspicious Pattern: os.environ.copy(. Data Exfiltration finding detected in
scripts/test_cli.py:213. - medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
Showing the 12 highest-severity of 17 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for anysearch
Audit external network connections
Eliminate dynamic code execution
Add a config.json permissions manifest
Related Security Research
ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on September 17, 2026. anysearch is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.