Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward web-search skill that sends search queries to Keenable's public endpoint and does not show hidden persistence, credential use, destructive actions, or unrelated behavior.
Install only if you are comfortable sending your search queries and filters to Keenable's public search service. Avoid putting secrets, private internal details, personal data, or regulated information into searches unless you have reviewed Keenable's handling of that data.
The skill invokes a bundled Python script that performs outbound network access, but the manifest does not declare any explicit tool scope or permission boundary. This creates a transparency and governance gap: users and host systems cannot easily tell that activating the skill will transmit data off-system to a third-party endpoint.
The trigger search online is close to a common built-in search command, creating a shadowing risk where this third-party skill may intercept requests intended for the platform's native tool. In context, that matters because the skill performs external network requests to a specific vendor endpoint, changing data flow and trust assumptions without a clear boundary.
The trigger find sources overlaps with common assistant behavior and may conflict with built-in discovery or retrieval commands. This increases the chance of unintended activation and external query transmission, especially in normal research-oriented conversations where the user did not knowingly opt into a third-party endpoint.
Several triggers are broad everyday phrases like research, news, look it up, and web search, which can cause accidental invocation in unrelated conversations. When a networked skill auto-activates too easily, sensitive user prompts or internal context may be sent externally without deliberate user intent.
The skill description emphasizes that it is keyless and easy to use, but does not prominently warn that user search terms are transmitted to an external public endpoint. This is dangerous because users may include confidential, regulated, or proprietary information in queries under the mistaken assumption that the operation is local.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.error
import urllib.request
SEARCH_URL = "https://api.keenable.ai/v1/search/public"
APP_TITLE = "OpenClaw Skill" # attribution tag for keyless traffic (X-Keenable-Title)
_PARAMS = ("site", "published_after", "published_before", "acquired_after", "acquired_before")
No suspicious patterns detected.