Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward cloud search wrapper that sends search requests to Claw0x and does not show hidden or destructive behavior.
Install only if you are comfortable sending your search query, filters, and requested result options to Claw0x's external API and paying per successful call. Do not include secrets, regulated data, or confidential internal research terms in searches unless your organization permits that use.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Add to ~/.openclaw/.env
CLAW0X_API_KEY=ck_live_...
The skill requires environment access for an API key and performs outbound network requests, but it does not declare an explicit tool/permission scope. This weakens least-privilege controls and prevents users or orchestrators from clearly understanding and constraining what the skill can access.
The skill markets search capabilities but does not clearly warn users that queries and related filters are transmitted to a third-party cloud API. Users may unknowingly send sensitive research terms, company names, or other confidential inputs off-platform.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Add to ~/.openclaw/.env
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const response = await fetch('https://api.claw0x.com/v1/call', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.CLAW0X_API_KEY}`,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const response = await fetch('https://api.claw0x.com/v1/call', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.CLAW0X_API_KEY}`,
The skill transmits the user’s search query and all provided options to a third-party service at api.claw0x.com, but the code contains no in-band disclosure, consent check, or minimization of potentially sensitive user input. In an agent skill context, users may assume queries are handled locally or by the primary platform, so silent forwarding to an external provider creates a real data exposure and privacy risk.
This code performs an outbound network request to a third-party endpoint and includes the full user-controlled input object in the request body. Even though external search is the purpose of the skill, unrestricted transmission to an external service is security-relevant because it can leak sensitive prompts, research topics, internal URLs, or other data supplied by the user or agent.
}
// Call Claw0x Gateway API
const response = await fetch('https://api.claw0x.com/v1/call', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
This code performs an outbound network request to a third-party endpoint and includes the full user-controlled input object in the request body. Even though external search is the purpose of the skill, unrestricted transmission to an external service is security-relevant because it can leak sensitive prompts, research topics, internal URLs, or other data supplied by the user or agent.
}
// Call Claw0x Gateway API
const response = await fetch('https://api.claw0x.com/v1/call', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
Detected: suspicious.env_credential_access