xAI Grok Search

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.env_credential_access

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Using the skill can consume your xAI account quota or billing allowance tied to the configured API key.

Why it was flagged

The skill uses an xAI API key from the environment as a Bearer token. This is necessary for the stated xAI API integration, but the key may grant account access or incur usage costs.

Skill content

if (!process.env.XAI_API_KEY) { ... } ... 'Authorization': `Bearer ${process.env.XAI_API_KEY}`

Recommendation

Use a dedicated xAI API key if possible, monitor usage, and revoke/rotate the key if you uninstall or stop trusting the skill.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Sensitive search terms or private context included in a query may be processed by xAI.

Why it was flagged

The user's search query is sent to xAI's external API. This is disclosed and purpose-aligned, but it means query text leaves the local environment.

Skill content

fetch('https://api.x.ai/v1/responses', { ... body: JSON.stringify({ model, input: [{ role: 'user', content: query }], tools: [tool] }) })

Recommendation

Avoid putting secrets, private personal data, or confidential business information in search queries unless you are comfortable sending that data to xAI.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

It may be harder to verify the publisher or track updates from an authoritative repository.

Why it was flagged

The source is listed as unknown and the homepage appears to use a placeholder GitHub path. This does not show malicious behavior, especially because the included code is simple and fully provided, but it weakens provenance.

Skill content

Source: unknown; Homepage: https://github.com/yourusername/xai-grok-search

Recommendation

Install only if you trust the registry publisher or can independently verify the code and intended repository.

Findings (1)

critical

suspicious.env_credential_access

Location: search.mjs:24
Finding: Environment variable access combined with network send.