博查搜索
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a straightforward Bocha web-search wrapper, but it requires a Bocha API key and sends search terms to Bocha’s API.
This skill looks coherent for web search. Before installing, be aware that you must provide a Bocha API key even though the registry requirements do not declare one, and that any search queries submitted through the skill will be sent to Bocha’s API and may use your account quota or balance.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Search requests may use the user's Bocha account quota or billing balance.
The script authenticates to Bocha using a bearer API key from the environment or local config. This is expected for the stated search API purpose, but it means calls are made under the user's Bocha account and may consume quota or balance.
const DEFAULT_API_KEY = process.env.BOCHA_API_KEY || configKey || ''; ... 'Authorization': `Bearer ${apiKey}`Configure a dedicated, rotatable Bocha API key intentionally, monitor usage, and revoke or rotate the key if the skill is no longer used.
Bocha may receive and process the search terms and options submitted through this skill.
The skill sends the user's search query and options to Bocha's external API. This is disclosed and central to the search function, but users should know their query text leaves the local environment.
const API_URL = 'https://api.bocha.cn/v1/web-search'; ... const payload = JSON.stringify({ query: query, count: options.count || 10, freshness: options.freshness || 'noLimit', summary: options.summary || false });Avoid submitting confidential or regulated information as search queries unless Bocha’s data handling terms are acceptable for the intended use.