Octen Search

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent web search skill that uses an Octen API key and sends search queries to Octen as disclosed.

This skill appears safe for its stated purpose. Before installing, make sure you are comfortable providing an Octen API key and sending search queries to Octen; avoid using it for confidential or secret information unless that data sharing is acceptable.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone using the skill needs to provide an Octen API key, which may allow API usage or billing under that account.

Why it was flagged

The skill reads a local API credential and uses it to authenticate requests to Octen; this is disclosed and expected for the search service.

Skill content

api_key = os.environ.get('OCTEN_API_KEY', '').strip() ... 'X-Api-Key': api_key

Recommendation

Use a scoped Octen API key if available, keep it out of logs and shared environments, and rotate it if it is exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search terms may reveal sensitive topics or information to the Octen service.

Why it was flagged

The user-provided search query and filters are sent to an external Octen API endpoint; the endpoint is hardcoded and disclosed.

Skill content

ALLOWED_API_ENDPOINT = "https://api.octen.ai/search" ... body = { 'query': query, 'count': max(1, min(count, 20)) } ... data=json.dumps(body).encode('utf-8')

Recommendation

Avoid putting secrets, private customer data, or confidential internal details into search queries unless sending them to Octen is acceptable.