T09 · Insecure Skill Coding Practices
Error
- Location
scripts/web_search.py:49- Finding
API Key Is Transmitted to an Undocumented Non-Volcengine Domain
- Content
View full analysis
- Remediation
View remediation
Security audit
Byted Web Search
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real web-search client, but it repeatedly asks users to paste API keys into chat and uses broader credential/search behavior than users are likely to expect.
Review before installing. Use a dedicated skill credential setting or tightly scoped environment variable, not chat, for any API key; rotate the key if it has already been pasted into a conversation. Be aware that search queries and bearer API keys may be sent to open.feedcoopapi.com in the API-key flow, and avoid running the skill with access to shared .env files containing unrelated secrets.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/web_search.py:54- Finding
Broad Loading of Shared OpenClaw Environment Files Violates Least Privilege
- Content
View full analysis
None: if not os.path.exists(env_path): return try: with open(env_path, "r", encoding="utf-8") as f: for raw_line in f: line = raw_line.strip() if not line or line.startswith("#"): continue if line.startswith("export "): line = line[len("export "):].strip() if "=" not in line: continue key, value = line.split("=", 1) key = key.strip() value = value.strip() if not key: continue try: parsed = shlex.split(value, comments=True) value = parsed[0] if parsed else "" except ValueError: value = value.strip("\"'") os.environ.setdefault(key, value) except OSError: return def _load_legacy_env_files() -> None: seen_paths = set() for env_path in (LEGACY_ENV_PATH, USER_ENV_PATH): normalized = os.path.abspath(os.path.expanduser(env_path)) if normalized in seen_paths: continue seen_paths.add(normalized) _load_legacy_env_file(normalized) ``` ```python def main(): _load_legacy_env_files() _skill_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) _load_legacy_env_file(os.path.join(_skill_root, ".env")) ``` ### Technical Analysis The Skill requires at most three credential variables: - `WEB_SEARCH_API_KEY` - `VOLCENGINE_ACCESS_KEY` - `V ...[truncated 2504 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:22- Finding
Documentation Encourages Users to Submit Long-Lived API Keys Through Chat
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:5- Finding
Overbroad Self-Routing Instructions Hijack Agent Search Behavior
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (33)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README explicitly tells users to paste an API key directly into the chat interface, which creates a real credential-handling risk. Chat channels may be logged, retained, exposed to other tools, or visible to unintended parties, so encouraging secret transmission through chat can lead to credential leakage and unauthorized API use.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation guidance uses very common conversational phrases as triggers, so the skill may be invoked when the user did not actually request web access. In an agent setting, overly broad routing can cause unnecessary external data transmission and unexpected tool use.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file instructs the agent to proactively invoke the skill even without explicit search intent, but it does not set firm boundaries for when that is appropriate. This can turn normal conversation into implicit web queries, exposing user content to third-party services without clear necessity or consent.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Treating broad fuzzy words as sufficient reason to prioritize invocation creates collision-prone routing. Common words like 'recommend', 'current', or 'is it true' appear in many contexts, so the skill could capture requests that should remain local or use a different tool.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The weak-intent table encourages activation across many everyday expressions without guardrails such as consent, sensitivity checks, or ambiguity handling. In practice this broadens the attack surface for accidental exfiltration of user queries and for unnecessary dependency on remote services.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The 'appear then consider invocation' keyword list is expansive and lacks counterexamples or disambiguation guidance. Keyword-triggered behavior at this breadth is brittle and can be manipulated or accidentally matched, resulting in unintended external searches.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 在调用 `web_search.py` 之前：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 在调用 `web_search.py` 之前：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 在调用 `web_search.py` 之前：
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide explicitly tells users to paste an API key into the chat, which exposes a reusable secret to the conversational channel, agent runtime, logs, transcripts, and any downstream integrations that can access message history. This exceeds the minimum access needed for the web-search skill and creates unnecessary credential disclosure risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document instructs users to paste an API key directly into chat without any warning about credential exposure, which encourages unsafe handling of secrets. Because the skill is for online search and does not inherently require the model to see raw credentials in conversation, this creates avoidable risk with no clear necessity.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a direct instruction to disclose an API key to the agent in chat, which is sensitive-data handling contrary to least-privilege practices. In an agent skill, the danger is amplified because conversation content may be accessible to the model, platform operators, logs, and potentially other tools or memory features.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The configuration section prioritizes giving the key to the agent in chat over safer configuration paths, normalizing insecure secret handling. In the skill context this is especially dangerous because the agent may retain, summarize, forward, or expose the credential beyond the user's intended one-time setup.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The configuration guidance again encourages handing the key to the agent in chat while omitting any caution about transcript retention or unauthorized access. This omission makes the workflow more dangerous by presenting insecure secret disclosure as the preferred user experience.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The section explicitly makes handing the key to the agent the preferred path, subordinating secure local setup to a less secure conversational workflow. That design choice materially increases the chance of credential compromise and misuse if transcripts are retained, exported, or viewed by unintended parties.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python TRAFFIC_TAG_VALUE = "skill_web_search_common" TIME_RANGE_SHORTCUTS = {"OneDay", "OneWeek", "OneMonth", "OneYear"} DATE_RANGE_PATTERN = re.compile(r"^(\d{4}-\d{2}-\d{2})\.\.(\d{4}-\d{2}-\d{2})$") LEGACY_ENV_PATH = "/root/.openclaw/.env" USER_ENV_PATH = str(Path.home() / ".openclaw/.env") SUMMARY_PREVIEW_LIMIT = 1000 ERROR_HINTS = {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python TRAFFIC_TAG_VALUE = "skill_web_search_common" TIME_RANGE_SHORTCUTS = {"OneDay", "OneWeek", "OneMonth", "OneYear"} DATE_RANGE_PATTERN = re.compile(r"^(\d{4}-\d{2}-\d{2})\.\.(\d{4}-\d{2}-\d{2})$") LEGACY_ENV_PATH = "/root/.openclaw/.env" USER_ENV_PATH = str(Path.home() / ".openclaw/.env") SUMMARY_PREVIEW_LIMIT = 1000 ERROR_HINTS = {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python TRAFFIC_TAG_VALUE = "skill_web_search_common" TIME_RANGE_SHORTCUTS = {"OneDay", "OneWeek", "OneMonth", "OneYear"} DATE_RANGE_PATTERN = re.compile(r"^(\d{4}-\d{2}-\d{2})\.\.(\d{4}-\d{2}-\d{2})$") LEGACY_ENV_PATH = "/root/.openclaw/.env" USER_ENV_PATH = str(Path.home() / ".openclaw/.env") SUMMARY_PREVIEW_LIMIT = 1000 ERROR_HINTS = {
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README is entirely written in Chinese and describes the skill workflow only in that language, with no indication that other languages are supported or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicit and justified.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents capabilities that rely on environment variables, local files (.env), and outbound network access, but it does not declare any explicit tool scope or permissions. That makes its effective privileges implicit, which increases the chance of over-broad execution in hosts that support capability gating or user review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instruction "给用户的回复必须极简" is paired with a fixed Chinese reply template and does not indicate that the language should follow the user's preference. Because no opt-in or documented region-specific justification is provided, this can violate language/locale choice policy.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs users to paste an API key into the chat, normalizing transmission of secrets through a natural-language channel that may be logged, retained, or exposed to unintended parties. This creates a direct credential disclosure pattern and increases the likelihood of key compromise.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Examples such as "怎么用", "教我用", and "这个 skill 能干啥" are ordinary help phrases and are treated as sufficient to trigger onboarding behavior. The file does not clearly separate general discussion about the skill from actual intent to perform web search.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The repeated guidance reinforces a habit of sending credentials in chat, which compounds the risk of leakage through logs, screenshots, transcripts, or model/provider retention. Repetition makes the unsafe behavior appear endorsed and routine.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The troubleshooting guidance tells users to resend the correct key in chat, reinforcing repeated disclosure of a sensitive credential through an insecure channel. Repeated sharing increases the chance of leakage through logs, support review, transcript retention, or accidental reuse in other contexts.
- Content