Moark Web Search
Analysis
This is a straightforward web-search skill that uses a disclosed Gitee AI API key and endpoint, with only normal cautions about credential handling and installing an unpinned dependency.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Ensure you have installed the required dependency (`pip install requests`).
The setup relies on a user-installed, unpinned Python package. This is normal for a small API wrapper, but users should install it from a trusted package source.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
return os.environ.get("GITEEAI_API_KEY") ... "Authorization": f"Bearer {api_key}"The script uses an API key from the environment or CLI argument as a bearer token for the web-search service. This is disclosed and purpose-aligned, but it means the skill can use the user's Gitee AI API access.