ClawHub
Back to skill

Security audit

Bocha Web Search A2M

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed paid Bocha web-search skill that sends search queries to Bocha and uses an Alipay 402 payment flow, with no hidden code or persistence found.

Before installing, understand that search queries may be sent to Bocha and may lead to a paid Alipay 402 flow. Use it only when you want this provider, avoid sensitive search terms, and review the separate Alipay payment skill before completing any payment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger conditions are extremely broad and effectively match most generic web-search requests, which increases the chance that the skill is auto-invoked when the user did not explicitly consent to using a paid third-party service. In this context, overbroad routing can lead to unnecessary external data transmission and unintended payment prompts, making it a real security and safety issue rather than a purely UX concern.

External Transmission

Medium
Category
Data Exfiltration
Content
向博查 API 发起 POST 请求：

```bash
curl -X POST "https://api.bocha.cn/v1/marketplace/alipay/bochawebsearch" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "<用户搜索词>",
Confidence
91% confidence
Finding
curl -X POST "https://api.bocha.cn/v1/marketplace/alipay/bochawebsearch" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
向博查 API 发起 POST 请求：

```bash
curl -X POST "https://api.bocha.cn/v1/marketplace/alipay/bochawebsearch" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "<用户搜索词>",
Confidence
91% confidence
Finding
https://api.bocha.cn/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.