Swiss Phone Directory

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to be a straightforward search.ch directory lookup tool, with expected API-key use and expected external lookup requests.

Before installing, make sure you are comfortable providing a search.ch API key and sending lookup terms such as names, phone numbers, and locations to search.ch. Store the API key carefully, avoid committing it to dotfiles or gateway config, and correct the documented script path if needed.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill can use your search.ch API key and associated quota when performing lookups.

Why it was flagged

The code reads the `SEARCHCH_API_KEY` credential and includes it in requests to the search.ch API. This is disclosed and necessary for the stated purpose, but it is still credential use.

Skill content

api_key = get_api_key()
...
params = {
    "was": query,
    "key": api_key,
    "lang": lang,
    "maxnum": min(limit, 200)
}

Recommendation

Use a dedicated search.ch API key, avoid committing it to shared files or repositories, and rotate it if it is exposed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Names, phone numbers, business categories, or locations entered for lookup may be processed by search.ch.

Why it was flagged

Search terms, phone numbers, and optional locations are sent to the external search.ch API. This is clearly aligned with the skill's purpose, but users should understand the data flow.

Skill content

API_BASE = "https://search.ch/tel/api/"
...
params = {
    "was": query,
    "key": api_key,
    "lang": lang,
    "maxnum": min(limit, 200)
}
...
if location:
    params["wo"] = location
...
with urllib.request.urlopen(url, timeout=15) as response:

Recommendation

Use the skill only for queries you are comfortable sending to search.ch, and review search.ch API terms and privacy expectations.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The example commands may fail unless the script path is corrected.

Why it was flagged

The documentation references `scripts/searchch.py`, while the supplied file is listed as `searchch.py` at the root. This is a coherence issue that could confuse installation or invocation, but it does not show malicious behavior.

Skill content

SKILL.md: `python3 scripts/searchch.py search "Migros" --location "Zürich"`
File manifest: `searchch.py (10779 bytes)`

Recommendation

Update the documentation or file layout so the command path matches the packaged script.