Security audit
Security checks for vulnerabilities and agentic risk
This is a real search and content-extraction skill, but it uses broad network access and local credentials in ways users may not expect.
Install only if you are comfortable with a search tool that contacts multiple third-party APIs, fetches arbitrary URLs from your machine's network context, writes extracted documents to the OpenClaw workspace, and may use local GitHub credentials automatically. Avoid using it with secrets, internal-only URLs, private documents, or regulated data unless you first constrain credentials, disable unwanted providers, and run it behind network egress controls.
scripts/local-content-extract.py:51Unrestricted URL Fetching Enables Server-Side Request Forgery
vendor/openclaw-search-skills/search-layer/scripts/fetch_thread.py:70Credential Discovery and Broad Subprocess Inheritance Violate Least Privilege
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Even if some claimed features exist elsewhere, this file does not accurately describe which standalone scripts implement default routing, legacy behavior, or content conversion. Ambiguous or overstated capabilities are dangerous because users cannot reliably predict what a given invocation will do, especially when multiple external services and local scripts are involved.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
)
def unified_search(query: str) -> str:
"""Run unified-search.sh with the given query and return results."""
env = os.environ.copy()
env.setdefault("OPENCLAW_CONFIG", os.path.expanduser("~/.openclaw/openclaw.json"))
result = subprocess.run(
The README directs users to create and populate a .env file with a MinerU token, but provides no warning about securing that secret or preventing accidental inclusion in repositories, support bundles, or shared workspaces. Because API tokens can grant billable access and data-processing privileges, exposure can lead to account abuse and unauthorized access to extracted content flows.
只有当你需要抓取微信/知乎/小红书等反爬站点时才需要：
cp mineru-extract/.env.example mineru-extract/.env
# 编辑 .env，填入你的 MinerU token（从 https://mineru.net/apiManage 获取）
The skill routes content to an external MinerU API during fallback but does not clearly disclose that user-provided URLs or fetched page content may leave the local environment. This creates a real data-handling and privacy risk, especially if users submit internal, sensitive, or regulated content assuming local-only processing.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Env (load order):
- process env
- .env next to this script
- ../.env (skill root)
Required:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Env (load order):
- process env
- .env next to this script
- ../.env (skill root)
Required:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Env (load order):
- process env
- .env next to this script
- ../.env (skill root)
Required:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Env (load order):
- process env
- .env next to this script
- ../.env (skill root)
Required:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Env (load order):
- process env
- .env next to this script
- ../.env (skill root)
Required:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Env (load order):
- process env
- .env next to this script
- ../.env (skill root)
Required:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Env (load order):
- process env
- .env next to this script
- ../.env (skill root)
Required:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _bootstrap_env() -> None:
here = pathlib.Path(__file__).resolve()
_load_dotenv(here.parent / ".env")
_load_dotenv(here.parent.parent / ".env")
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _bootstrap_env() -> None:
here = pathlib.Path(__file__).resolve()
_load_dotenv(here.parent / ".env")
_load_dotenv(here.parent.parent / ".env")
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _bootstrap_env() -> None:
here = pathlib.Path(__file__).resolve()
_load_dotenv(here.parent / ".env")
_load_dotenv(here.parent.parent / ".env")
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _bootstrap_env() -> None:
here = pathlib.Path(__file__).resolve()
_load_dotenv(here.parent / ".env")
_load_dotenv(here.parent.parent / ".env")
The skill declares itself the default for ALL search/lookup needs and instructs the agent not to use raw web_search directly. That overly broad routing authority increases blast radius: any query needing web access may be funneled through a complex multi-source workflow with extra query expansion, external transmission, and optional deep extraction behaviors the user did not specifically request.
Detected: suspicious.dynamic_code_execution