Openclaw Grok Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:05 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it ships a non-placeholder API key and defaults users into a third-party proxy with weak credential handling.

Review before installing. Remove artifact/config.json or replace it with your own local config, rotate any exposed key, prefer GROK_API_KEY or a private config.local.json, verify the endpoint is one you trust, and avoid sending secrets, private code, personal data, or internal URLs as search queries. Pin the install source when possible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:2

Finding

Live API Credential Committed in Project Configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/grok_search.py:176

Finding

User Queries Are Silently Sent to a Bundled Third-Party Proxy

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/configure.py:35

Finding

API Credentials Are Stored Without Explicit Permission Hardening and May Be Sent over HTTP

Content

View full analysis

Path: custom = (os.environ.get("GROK_CONFIG_PATH") or "").strip() if custom: return Path(custom).expanduser() return Path(__file__).resolve().parent.parent / "config.json" ``` ```python config_path.write_text( json.dumps(config, ensure_ascii=False, indent=2) + "\n", encoding="utf-8", ) ``` Base URL normalization without scheme enforcement: ```python def _normalize_base_url(base_url: str) -> str: base_url = base_url.strip().rstrip("/") if base_url.endswith("/v1"): return base_url[: -len("/v1")] return base_url ``` Request URL construction: ```python url = f"{_normalize_base_url(base_url)}/v1/chat/completions" ``` ### Technical Analysis The configuration script stores the API key in plaintext using `Path.write_text()` without explicitly setting owner-only file permissions. The resulting permissions depend on the process umask, existing file mode, filesystem defaults, and platform behavior. On a shared system, another local account may be able to read the configuration. The network client also accepts an arbitrary base URL and does not require an `https` scheme. If a user, configuration file, or environment variable supplies an `http://` endpoint, the bearer credential and complete query are transmitted without TLS. An on-path attacker could read or alter the request and response. The current bundled endpoint uses HTTPS, so plaintext transport is not active under that specific configuration. The vulnerability becomes exploitable when the endpoint is overridden with an HTTP URL. Explicit validation is necessary because endpoint customization is a docume ...[truncated 1586 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tainted flow: 'timeout_seconds' from os.environ.get (line 345, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/grok_search.py (reported line 217)May include surrounding context.

python

headers=headers,
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=timeout_seconds) as resp:
        raw = resp.read().decode("utf-8", errors="replace")
        try:
            return json.loads(raw)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior promises real-time web research against a Grok-compatible endpoint and structured JSON output, but the analyzed skill content primarily describes local configuration and invocation flow without evidence of the claimed network/search implementation. This mismatch is security-relevant because users and higher-level agents may trust the skill for external verification while it may instead perform unexpected local actions or fail open in ways that conceal its true behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation is written entirely in Chinese and does not indicate that other languages are supported or provide an opt-in choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to install the skill via npx skills add Stemmaker/openclaw-grok-search without pinning a specific version or commit. This creates a supply-chain risk: users may receive a later modified package or dependency set than the one reviewed, and if the upstream package or referenced repo is compromised, arbitrary code could be installed or executed during setup.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises executable behavior that involves shell, file access, environment-variable use, and network activity, but it declares no explicit tool scope or permissions boundaries. In an agent ecosystem, this increases the chance of unintended execution with broader privileges than users or orchestrators expect, especially because the skill is project-local and instructs direct command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation rule 'You are uncertain and need external confirmation' is overly broad and can cause the skill to run in many routine situations, expanding the frequency of shell execution, config access, and network use. Broad triggering makes benign prompts more likely to invoke a higher-risk capability without strong necessity, increasing exposure to prompt-induced tool use and unnecessary data handling.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill instructs users to write configuration interactively and persist it in local project files, creating session persistence that may store API keys or endpoint settings beyond the immediate task. Persistent local secrets and settings increase the risk of later disclosure, misuse by other tools in the workspace, or accidental inclusion in version control.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Quick Start

1. Write config interactively (first run only).

bash

python scripts/configure.py

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script interactively collects an API key and persists it in plaintext JSON on disk without any explicit warning, masking, or permission hardening. This increases the chance that a user unknowingly stores sensitive credentials in a project directory that may be copied, backed up, shared, or committed to version control, leading to credential disclosure and misuse of the Grok endpoint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill can automatically execute a separate local script when configuration is missing, creating an implicit code-execution path that may surprise users and increase risk if the skill directory or configure.py is tampered with. In an agent context, auto-running helper scripts is more dangerous because installation paths, repositories, or local files may not always be trusted.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/grok_search.py (reported line 91)May include surrounding context.

python

sys.stderr.write("configure.py not found; cannot auto-configure.\n")
        return False
    try:
        run([sys.executable, configure_path], check=True)
    except CalledProcessError:
        sys.stderr.write("configure.py failed; aborting.\n")
        return False

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends the user-provided query to a remote OpenAI-compatible endpoint and also allows arbitrary extra headers and body fields to be transmitted. While the behavior is central to the script's purpose, there is no explicit user-facing notice in the code that query contents and configured metadata will be sent over the network.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Allowing arbitrary caller-supplied headers lets a caller override or inject security-relevant HTTP metadata, including Authorization, Host, or proxy-related headers, which can redirect trust or exfiltrate credentials to unintended endpoints. In this skill, that risk is amplified because the same request carries the API key and user query to a configurable remote service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest presents a focused web research/search tool returning content and sources, but the implementation accepts arbitrary extra JSON merged into the outbound API body. This broadens the effective remote capability beyond the declared search workflow by allowing callers to enable undocumented model/provider-specific features.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script reads API credentials from environment variables or config files and uses them for outbound authentication, but the code provides no explicit warning or documentation comment about credential handling. This can matter for auditing and operator awareness, especially when credentials are sourced from local config files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.