Bocha Web Search

Default web search tool using Bocha Web Search API. Use for online lookup, verification, time-sensitive information, and citation-based answers.

Security Scan

The skill is internally consistent: it is an instruction-only wrapper for the Bocha Web Search API and only requests the Bocha API key needed to perform searches.

Purpose & Capability

Name/description match the required pieces: the SKILL.md documents a web-search API endpoint at api.bocha.cn and declares BOCHA_API_KEY as the single required credential. There are no unrelated env vars, binaries, or config paths requested.

Instruction Scope

Runtime instructions are narrowly scoped to calling POST https://api.bocha.cn/v1/web-search with the API key and formatting citation-backed results. The doc does not instruct reading local files, other env vars, or exfiltrating data. One note: the guidance 'If uncertain whether online lookup is required, perform a search' gives the agent discretion to initiate searches when it deems necessary — expected for a search tool but worth knowing if you want strict limits on when external calls happen.

Install Mechanism

No install spec and no code files — instruction-only skill. This minimizes disk/write risk; nothing is downloaded or executed locally by the skill itself.

Credentials

Only BOCHA_API_KEY (primaryEnv) is required, which is proportionate to a web-search integration. No other tokens, secrets, or unrelated credentials are requested.

Persistence & Privilege

always is false and the skill is user-invocable (defaults). The skill can be invoked autonomously by the agent (disable-model-invocation is false), which is normal for search skills; this increases the chance it will make outbound queries but is not itself a misconfiguration.

Assessment

This skill appears to be what it claims: a thin wrapper around the Bocha Web Search API. Before installing, consider: (1) You must provide BOCHA_API_KEY — treat it like any API secret (limit scope, rotate if needed). (2) Queries and returned content will be sent to/received from api.bocha.cn; do not send sensitive or private data to the skill. (3) Because the agent can invoke the skill autonomously, it may perform searches whenever it decides a lookup is needed; if you want stricter control, disable autonomous invocation or require explicit user invocation only. (4) Review Bocha's privacy, logging, and retention policy and your organizational policy for third‑party APIs. (5) Monitor usage (cost/rate limits) and restrict the key if needed. These precautions will mitigate the primary risks (exposure of queries and the API key).

This skill performs web searches using the Bocha Web Search API.

It is designed to:

• Retrieve up-to-date information
• Verify factual claims
• Provide source-backed answers
• Support citation-based responses

This version avoids shell-specific instructions and system-level file operations to ensure compatibility with secure environments such as ClawHub.

---

When to Use This Skill

Use this skill whenever the user request:

• Requires information not present in the conversation
• Involves time-sensitive or changing data (news, policies, financial data, releases)
• Requires fact-checking or verification
• Requests links, sources, or citations
• Mentions a specific organization, event, person, or product and asks for factual details

If uncertain whether online lookup is required, perform a search.

---

API Specification

Endpoint:

POST https://api.bocha.cn/v1/web-search

Headers:

Authorization: Bearer <BOCHA_API_KEY> Content-Type: application/json

Request body (recommended defaults):

{ "query": "<USER_QUERY>", "freshness": "noLimit", "summary": true, "count": 10 }

Field meanings:

• query: search query string (required)
• freshness: time filter (e.g., noLimit, oneWeek, oneMonth)
• summary: whether to include summarized content
• count: number of returned results (1–50)

---

Response Structure

Search results are located at:

data.webPages.value[]

Each result typically contains:

• name (title)
• url
• snippet
• summary (original content)
• siteName
• datePublished

---

Citation Rules (Mandatory)

When generating the final answer:

1. Support factual statements using returned sources.
2. Assign citation numbers in order of appearance: [1], [2], [3]
3. End with a References section.
4. Each reference must include:
   • Title
   • URL
   • Site name (if available)

Example output format:

Answer:

<Your answer with inline citations like [1], [2].>

References

[1] <title> <url> Source: <siteName>

[2] <title> <url> Source: <siteName>

If no reliable sources are found, respond with: "No reliable sources found."

---

Error Handling

Common API error codes:

• 400: Bad request
• 401: Invalid API key
• 403: Insufficient balance
• 429: Rate limit exceeded
• 500: Server error

Use log_id from API responses for debugging if needed.