Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Skywork web-search integration, with disclosed API-key use and network calls, though users should handle the API key carefully.
Install only if you are comfortable sending search queries to Skywork and storing a Skywork API key for the skill. Prefer the OpenClaw-managed API-key configuration, avoid printing or sharing the key, and restrict access to any config files where you store it.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Option B — Claude Code settings
Add the variable to ~/.claude/settings.json:
{
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Option B — Claude Code settings
Add the variable to ~/.claude/settings.json:
{
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Option B — Claude Code settings
Add the variable to ~/.claude/settings.json:
{
The skill advertises executable behavior that uses environment variables, writes files, and performs network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: the runtime may permit broader capability use than a reviewer or orchestrator expects, increasing the chance of unintended data exposure or misuse.
Several listed trigger phrases such as 'search for,' 'look up,' and 'find information about' are generic and likely to appear in ordinary conversation, which can create trigger collisions. In this skill's context, that mainly risks unnecessary invocation of a networked tool and avoidable transmission of prompts or sensitive context to the external search service.
Several listed trigger phrases such as 'search for,' 'look up,' and 'find information about' are generic and likely to appear in ordinary conversation, which can create trigger collisions. In this skill's context, that mainly risks unnecessary invocation of a networked tool and avoidable transmission of prompts or sensitive context to the external search service.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Log in with your Skywork account
- Open account / Settings / API Key (**https://skywork.ai/?openApiKeySetting=1**)
- Create or copy your **API key**
If your organization uses a separate console or test environment, use the URL and credentials your team provides.
The guide tells users to place a live API key in shell startup files and config files, and to print it with echo, but it does not warn about credential exposure, file permissions, shell history, or masking secrets in logs/screenshots. This increases the chance of accidental disclosure of the Skywork credential to local users, backups, support bundles, or recorded terminal sessions.
No suspicious patterns detected.