Security audit
Bocha
Security checks for vulnerabilities and agentic risk
Overview
This package is a coherent Bocha web-search provider plugin that sends user search queries to Bocha using a configured API key, with no hidden install scripts, file access, or persistence found.
Before installing, understand that your search queries and Bocha API key will be sent to Bocha, or to a custom base URL if you configure one. Use the base URL override only with endpoints you trust, and store the API key through OpenClaw config or the BOCHA_API_KEY environment variable as documented.
SkillSpector was not run because this plugin release contains no bundled skills.
Endor dependency reachability
Checked Nov 14, 2026 · 12:34 PM UTC
Scan failed: Endor analysis failed. Request a rescan to try again.