Langextract Search

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to be a normal web search and structured extraction workflow, with expected external service, API key, and Python package dependency considerations.

Install only if you are comfortable with external search/model providers handling the queries and extracted content. Use a virtual environment, verify or pin Python dependencies, configure API keys carefully, and avoid putting real secrets in shared project files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing unpinned packages can pull newer package versions than the author tested.

Why it was flagged

The skill relies on user-installed, unpinned PyPI dependencies rather than a pinned install spec. This is purpose-aligned for a Python search tool, but users should trust and verify the packages they install.

Skill content

pip install requests ddgs langextract

Recommendation

Install in a virtual environment and consider pinning or reviewing dependency versions before use.

Low

#ASI03: Identity and Privilege Abuse

What this means

Provider API keys may authorize paid or account-scoped usage when the workflow runs.

Why it was flagged

The configuration expects API keys for the model backend and search provider. This is expected for the advertised integrations, but the registry metadata does not declare a primary credential.

Skill content

"apiKey": "VOLCENGINE_API_KEY" ... "apiKey": "ZHIPU_SEARCH_API_KEY"

Recommendation

Use least-privilege keys, prefer environment variables over hardcoding real secrets in conf.json, and avoid sharing configured files.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search queries, search-result text, and extraction prompts may be processed by third-party search or model providers.

Why it was flagged

The documented workflow sends combined search-result content to a configurable external model backend for extraction. This is central to the skill's purpose, but it is a data boundary users should notice.

Skill content

后端模型: 可配置，默认 `doubao-seed-2-0-code`（火山引擎 ARK） ... 输入: 搜索结果合并内容（智谱 + DuckDuckGo）

Recommendation

Do not use sensitive queries unless the configured providers and their privacy terms are acceptable.