Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward multi-provider search helper that uses configured API keys and sends search queries to the named search services.
Install only if you are comfortable sending your search queries to Tavily, Brave, and/or Perplexity and storing those providers' API keys in environment variables or ~/.openclaw/.env. Avoid using sensitive internal, personal, or secret data as search queries unless those providers are approved for that data.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method="POST",
)
with urllib.request.urlopen(req, timeout=30) as resp:
body = resp.read().decode("utf-8", errors="replace")
obj = json.loads(body)
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method="POST",
)
with urllib.request.urlopen(req, timeout=30) as resp:
body = resp.read().decode("utf-8", errors="replace")
obj = json.loads(body)
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method="POST",
)
with urllib.request.urlopen(req, timeout=30) as resp:
body = resp.read().decode("utf-8", errors="replace")
obj = json.loads(body)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def load_env_key(key_name: str) -> Optional[str]:
"""从环境变量或 ~/.openclaw/.env 加载 API Key"""
key = os.environ.get(key_name)
if key:
return key.strip()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if key:
return key.strip()
env_path = pathlib.Path.home() / ".openclaw" / ".env"
if env_path.exists():
try:
txt = env_path.read_text(encoding="utf-8", errors="ignore")
The skill documents code that reads environment-based API keys, accesses local files, and performs outbound network requests, but it declares no explicit tool scope or permissions boundary. This creates an authorization and transparency gap: users and platforms cannot easily determine what capabilities the skill requires, increasing the risk of over-broad execution or unintended data access.
The skill sends user queries to third-party providers including Tavily, Brave, and Perplexity, but the description does not clearly warn users that their prompts and related search data leave the local environment. This is dangerous because users may submit sensitive, proprietary, or personal information under the false assumption that processing is local or confined to the agent platform.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any, Dict, List, Optional
TAVILY_URL = "https://api.tavily.com/search"
BRAVE_URL = "https://api.search.brave.com/res/v1/web_search"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from typing import Any, Dict, List, Optional
TAVILY_URL = "https://api.tavily.com/search"
BRAVE_URL = "https://api.search.brave.com/res/v1/web_search"
def load_env_key(key_name: str) -> Optional[str]:
The script sends user-supplied search queries to multiple external providers without any explicit warning, consent step, or privacy notice at the CLI boundary. Queries may contain sensitive internal, personal, or proprietary information, so silent transmission to third parties creates a real privacy and data-handling risk in an agent skill context.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
return {"source": "perplexity", "error": "Missing PERPLEXITY_API_KEY", "results": []}
try:
url = "https://api.perplexity.ai/chat/completions"
payload = {
"model": "llama-3.1-sonar-small-128k-online",
"messages": [
The natural-language description, headings, and usage guidance are presented in Chinese throughout the skill file, with no indication that users may choose another language or that the skill is intentionally region-specific. This can amount to a language-policy violation when a specific language is effectively forced without opt-in.
The description is written entirely in Chinese, which can indicate a fixed language expectation in user-facing skill metadata. The file does not provide an alternative language option or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
Natural-language strings in the module docstring, argument help, errors, and markdown output are primarily in Chinese, effectively enforcing a locale for users of the skill. There is no opt-in, alternative language option, or documented justification that this tool is intended only for a Chinese-language environment.
No suspicious patterns detected.