Unified Web Search (Iyeque)

• Analyzed: May 14, 2026, 4:03 AM
• Findings: 1
• Version: 1.1.1
• Hash: f6d90cd7e66c81e22968f3703c4d9d3faeffc7b30d7c552c9623a56c15391509
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. Both the `SKILL.md` documentation and the `index.js` implementation demonstrate a strong focus on security, explicitly addressing command injection and path traversal risks. The `sanitizeQuery` function in `index.js` effectively removes quotes and blocks shell metacharacters, and the `execSync` call for Tavily search correctly wraps the sanitized query in double quotes. Local file searches are strictly confined to specific subdirectories within the OpenClaw workspace, with additional path resolution checks to prevent traversal. There is no evidence of malicious intent, data exfiltration, persistence, or prompt injection attempts against the agent.