grok-search

• Analyzed: May 12, 2026, 3:06 AM
• Findings: 1
• Version: 0.2.1
• Hash: aa72cf8689a5c6f9e7a970a4aef483857a0d7d47e569c71a3d5f533de555c798
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for 'grok-search' is benign. The scripts (`chat.mjs`, `grok_search.mjs`, `models.mjs`) legitimately access the `XAI_API_KEY` from environment variables or `~/.clawdbot/clawdbot.json` to authenticate with the official xAI API (api.x.ai). File system access is limited to reading this configuration and user-specified image files for vision chat, which is directly aligned with the skill's stated purpose. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution of arbitrary commands, persistence mechanisms, or prompt injection attempts against the OpenClaw agent in `SKILL.md`.