global-search
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This search skill is transparent about sending queries to an external service with an API key, but users should avoid sensitive searches and verify the provider before use.
Before installing, confirm you trust clb.ciglobal.cn, configure the API key securely, and avoid sending passwords, tokens, personal identifiers, confidential documents, or internal business details in search queries.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Search terms, including any sensitive text the user includes, may be sent to and retained by the external provider.
The skill discloses that user queries leave the local environment and go to a third-party provider, where they may be linked to an account.
This skill sends the user’s search query to an external web search service at `https://clb.ciglobal.cn/web_search` ... Queries are transmitted to a third-party service and may be associated with your account
Use this only for non-sensitive searches unless the user explicitly confirms, and verify the provider’s privacy and retention practices.
Anyone with the API key could potentially make requests as the user’s account for this search service.
The skill requires an account API key for authentication; this is expected for the service but is still a sensitive credential.
`GLOBAL_SEARCH_API_KEY`: API key obtained from https://clb.ciglobal.cn/apiKey/login
Store the key only in an environment variable or credential manager, do not hardcode it, and rotate it if it is exposed.
A comprehensive search may create more requests, account logs, and exposure of the same query than a simple lookup.
The comprehensive-search script turns one search into four parallel API requests to the provider-side search modes.
tasks = [fetch_data(semaphore, i) for i in range(1,5)] ... async with session.post(API_URL, headers=headers,data=data) as response
Use comprehensive search only when broad coverage is actually requested, and prefer the smallest necessary query scope.
Users or installers may not see the credential requirement until reading the skill documentation.
The registry requirements do not declare the API key that the skill documentation says is required, which is a packaging/metadata inconsistency.
Required env vars: none ... Env var declarations: none ... Primary credential: none
Update the registry metadata to declare `GLOBAL_SEARCH_API_KEY` and the external service dependency clearly.