Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Metaso web-search wrapper that sends user-provided search queries to the documented Metaso API using a declared API key.
Install this only if you are comfortable sending search queries, selected options, and your Metaso API bearer token to Metaso's API. Avoid putting private secrets or sensitive personal data into search queries, and consider adding a tighter runtime permission policy if your OpenClaw environment supports one.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
print("Error: 'q' (query) is required.")
sys.exit(1)
# Get API key from environment
api_key = os.getenv("METASO_API_KEY")
if not api_key:
print("Error: METASO_API_KEY not set in environment.")
The skill explicitly requires an environment secret and performs networked API access, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. That makes the skill's effective capabilities broader and less auditable, increasing the risk of unintended secret use or network actions when integrated into an agent runtime.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --location 'https://metaso.cn/api/v1/search' \
--header 'Authorization: Bearer YOUR_API_KEY' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"Content-Type": "application/json"
}
response = requests.post(url, json=request_body, headers=headers, timeout=30)
response.raise_for_status()
return response.json()
The markdown includes Chinese-only labels and example query text such as '官方文档' and '搜索关键词', but does not indicate that the skill supports multiple languages or that Chinese is optional. This can violate language/locale policy expectations by implicitly forcing a specific language presentation without user opt-in.