bocha-skill

• Analyzed: May 12, 2026, 3:23 AM
• Findings: 1
• Version: 1.0.0
• Hash: 269e2683c28789057eed023cec2a4caca1adcf082c64e7ed19f4aacc6558ece8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to perform web searches using the Bocha AI Search API. The `scripts/bocha_search.js` file correctly retrieves the `BOCHA_API_KEY` from environment variables and makes a standard HTTPS POST request to `https://api.bocha.cn/v1/web-search`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the AI agent in any of the analyzed files. The `publish.sh` script and markdown files (`SKILL.md`, `README.md`, `PUBLISH.md`, `QUICK_PUBLISH.md`) contain instructions for developers and users, which are aligned with publishing and using the skill, without any malicious intent.