v1.0.0

BigModel Web Search Fallback

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:50 AM.

Analysis

This appears to be a coherent BigModel/Zhipu web-search fallback, with the main user-visible risks being use of a BigModel API key and sending search queries to an external provider.

GuidanceBefore installing, confirm you are comfortable providing a BigModel/Zhipu API key and sending search queries to open.bigmodel.cn. The artifacts do not show local file access, persistence, hidden endpoints, or destructive behavior.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/zhipu_web_search.py

os.environ.get("ZAI_API_KEY") or os.environ.get("ZHIPUAI_API_KEY") or os.environ.get("BIGMODEL_API_KEY") ... "Authorization": f"Bearer {api_key}"

The script reads a BigModel/Zhipu API key from environment variables and sends it as bearer authentication to the provider. This is expected for the stated API integration, but it gives the skill access to the user's API account/quota and is not reflected in the registry credential declarations.

User impactUsing the skill may consume the user's BigModel/Zhipu API quota or billing allocation.

RecommendationUse a scoped API key where possible, monitor provider usage, and update metadata to declare the expected API-key environment variables.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

scripts/zhipu_web_search.py

WEB_SEARCH_URL = f"{BASE_URL}/paas/v4/web_search"
CHAT_URL = f"{BASE_URL}/paas/v4/chat/completions"

The skill sends search queries or chat prompts to BigModel/Zhipu endpoints. This is disclosed and purpose-aligned, but it means user-provided query text crosses an external provider boundary.

User impactSearch questions, prompts, and related parameters may be processed by BigModel/Zhipu rather than staying local.

RecommendationAvoid sending sensitive or confidential information in queries unless that provider use is acceptable under the user's privacy and data-handling requirements.