Querit Web Search

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward Querit web-search wrapper that uses a Querit API key and sends search requests to Querit's API.

Install only if you are comfortable giving the skill a Querit API key and sending your search terms and filters to Querit. Avoid sensitive queries unless they are appropriate to share with that provider.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Searches will be made under the user's Querit account and may consume quota or reflect that account's access.

Why it was flagged

The script reads the Querit API key from the environment and uses it to authenticate API requests.

Skill content

api_key = os.getenv("QUERIT_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a Querit key intended for this skill, keep it out of prompts and logs, and rotate it if it is exposed.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Anything placed in the search query or filters is transmitted to Querit, so sensitive terms could leave the local environment.

Why it was flagged

The script sends the user's search query and filters as JSON to Querit's external API.

Skill content

url = "https://api.querit.ai/v1/search" ... requests.post(url, headers=headers, json=payload_data, timeout=30)

Recommendation

Avoid putting secrets, private documents, or confidential personal data in search queries unless you intend to share them with Querit.