Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed You.com search and extraction helper that sends user-provided queries or URLs to documented external APIs.
Install only if you are comfortable sending search queries and submitted URLs to You.com and ydc-index.io. Do not use it with secrets, private/internal URLs, regulated data, or sensitive repository content, and confirm any paid research or extraction call before use.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The API key is not loaded. Source your .env or restart the gateway:
source ~/.openclaw/.env
systemctl --user restart openclaw-gateway
This code sends the provided research query to an external service at api.you.com and authenticates with an environment-sourced API key. While the module docstring notes the API key requirement, there is no user-facing notice at execution time or inline warning that the user's input will be transmitted to a third-party service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"query": query,
"num_results": min(num_results, 10),
}
url = "https://api.you.com/v1/agents/search?" + urllib.parse.urlencode(params)
req = urllib.request.Request(
url,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"query": query,
"num_results": min(num_results, 10),
}
url = "https://api.you.com/v1/agents/search?" + urllib.parse.urlencode(params)
req = urllib.request.Request(
url,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"query": query,
"num_results": min(num_results, 10),
}
url = "https://api.you.com/v1/agents/search?" + urllib.parse.urlencode(params)
req = urllib.request.Request(
url,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"query": query,
"num_results": min(num_results, 10),
}
url = "https://api.you.com/v1/agents/search?" + urllib.parse.urlencode(params)
req = urllib.request.Request(
url,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"query": query,
"num_results": min(num_results, 10),
}
url = "https://api.you.com/v1/agents/search?" + urllib.parse.urlencode(params)
req = urllib.request.Request(
url,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"query": query,
"num_results": min(num_results, 10),
}
url = "https://api.you.com/v1/agents/search?" + urllib.parse.urlencode(params)
req = urllib.request.Request(
url,
The script can write the research response to an arbitrary output file via --out, but there is no confirmation prompt, log message, or warning near the write operation. For code files, file writes that lack any user disclosure may warrant a finding unless clearly disclosed elsewhere.
No suspicious patterns detected.