Security audit

bocha-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Bocha web-search integration, but the package includes a concrete API-key-shaped secret and publishing helper commands that deserve review before installation or reuse.

Install only if you intend to send search queries to Bocha's API and can provide your own BOCHA_API_KEY. Do not use or copy the sk- key shown in PUBLISH.md; it should be rotated by the publisher if it was ever valid. Avoid running publish.sh unless you are comfortable with it installing a global npm CLI, and review any delete commands before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: PUBLISH.md:29
Finding: Hardcoded Bocha API Credential in Published Documentation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: publish.sh:18
Finding: Automatic Installation of an Unpinned Global npm Package
Content: View full analysis
/dev/null; then echo -e "${YELLOW}⚠️ clawdhub CLI 未安装，正在安装...${NC}" npm install -g clawdhub fi ``` Related unpinned installation instructions also appear in `README.md`, `PUBLISH.md`, and `QUICK_PUBLISH.md`. ### Technical Analysis The publishing script automatically installs the latest version of the `clawdhub` npm package globally when a command with that name is not already available. No exact version, lockfile, integrity digest, or artifact signature is specified. Consequently, the code executed by this step can differ from the code that was reviewed. npm package installation may execute package lifecycle scripts under the privileges of the user running `publish.sh`. A compromised package release, maintainer account, registry response, or transitive dependency could therefore introduce arbitrary local code execution. Global installation also modifies shared user or system tooling rather than containing the dependency within the project. ### Attack Path 1. An attacker compromises the relevant package, one of its dependencies, its publisher account, or the package delivery channel. 2. The attacker publishes a malicious version under the package name used by the script. 3. A user without an existing `clawdhub` executable runs `publish.sh`. 4. The script invokes `npm install -g clawdhub` without pinning or integrity verification. 5. npm retrieves the mutable package release and runs any applicable installation lifecycle code. 6. Malicious code executes with the permissions of the user running the publishing script. This path is contingent on a supply-chain compromise; the audited package itself does not contain evidence that the current `clawdhub` package is malicious. ### Impact Assessm ...[truncated 645 chars]
Remediation: View remediation
``` 4. Commit and enforce a lockfile with package integrity metadata. 5. Prefer a project-local executable invoked through a controlled package script rather than a global installation. 6. Verify the package's official ownership, provenance, release signatures, and integrity before use. 7. Use `npm ci` in a restricted build environment and consider disabling lifecycle scripts where they are unnecessary. 8. Run publishing in an isolated, least-privileged environment with narrowly scoped credentials. 9. Add dependency scanning and review updates before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: publish.sh:47
Finding: ClawdHub API Token Is Read with Terminal Echo Enabled
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The example shows a realistic secret format (sk-...) without an explicit warning that it is not a reusable credential, making accidental reuse or disclosure more likely. In skill-publishing documentation, readers often copy-paste commands verbatim, so a real-looking key materially increases the chance of secret leakage and unauthorized third-party use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose describes an end-user search capability using the Bocha AI Search API. The actual code chunk does not implement search, call the Bocha API, or handle web/image/news queries at all. Its primary purpose is release automation: ensuring the ClawdHub CLI is installed, authenticating to ClawdHub, collecting publishing metadata, and publishing the skill. These are materially different behaviors and include undeclared capabilities such as package publication, CLI installation, and credential handling for ClawdHub.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document embeds a concrete-looking BOCHA_API_KEY value directly in a shell command, which contradicts its own guidance against hardcoding secrets. If this token is real or was copied from a real environment, it could be harvested from the published skill and abused to consume API quota or access the Bocha service under the author's account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 对于 markdown 文件，SQP-2 要求对可能影响系统完整性或造成不可逆后果的行为提供用户警示。L247 给出了 clawdhub delete ... --yes 的删除命令，且 --yes 会跳过交互确认，但文档未说明该操作可能不可恢复、会影响现有用户或应先二次核对目标版本。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language description says the skill is designed for Chinese search and gives a Chinese-language usage example, presenting a locale-specific behavior. Under SQP-3, forcing a specific language or locale without user opt-in or clear justification can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide includes a destructive clawdhub delete bocha-search --yes command that bypasses confirmation and is presented as a normal troubleshooting step without an explicit warning about irreversibility or scope. In a publish guide, users may copy-paste commands verbatim, so this increases the chance of accidental deletion of a published skill or related account resource.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explains that user queries are sent to Bocha's external API but does not clearly warn users that their search terms will leave the local environment and be processed by a third party. In a search skill, queries may contain sensitive internal data, so lack of explicit disclosure creates a real privacy and data-handling risk even if the transmission is functionally expected.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This line documents active transmission of user-provided search data to an external API endpoint. External transmission is expected for a web-search skill, but it remains security-relevant because prompts, search terms, and possibly metadata may be exposed to a third-party service outside the user's trust boundary.
Content: Scanner excerpt · README.md (reported line 110)May include surrounding context.
md
1. 用户输入搜索请求 2. OpenClaw 识别并路由到 bocha-search skill 3. 脚本读取 `BOCHA_API_KEY` 环境变量 4. 调用博查 API: `POST https://api.bocha-ai.com/v1/web-search` 5. 格式化结果为 Markdown 输出 ## 发布到 ClawdHub

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 208)May include surrounding context.
md
**解决**: 1. 检查网络连接 2. 确认 API 端点可访问：`curl https://api.bocha-ai.com/v1/web-search` 3. 检查防火墙设置 ## 许可证

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares network and environment-variable usage but does not explicitly scope or disclose those capabilities through permissions or allowed-tools. This weakens reviewability and user consent, making it easier for a skill to access secrets and send data externally without clear guardrails.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description explains setup and features but does not clearly warn users that their queries will be transmitted to Bocha's external API. Users may unknowingly send sensitive personal, corporate, or regulated data to a third party, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 73% confidence
Finding: The documentation tells users to store a long-lived API key in persistent OpenClaw configuration or environment variables without discussing secure storage or least privilege. Persistent credential storage increases the blast radius if the local machine, config files, logs, or subprocess environment are exposed.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
1. Visit [博查AI开放平台](https://open.bocha.cn/) 2. Register an account (注册账号) 3. Create an application and get your API KEY 4. Recharge if needed (充值以获得搜索额度) ### Step 2: Configure OpenClaw

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The routing statement says the skill may automatically trigger on Chinese queries or broad terms like 'search', which can cause unintended invocation. That increases the chance that user prompts, including sensitive research queries, are silently sent to a third-party provider without deliberate user choice.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill is designed to send data to an external API endpoint, which is expected behavior for a web search integration, but it still creates real data-exfiltration risk. Any user query, potentially including sensitive content, will leave the local environment and be processed by a third party.
Content: Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.
md
## Technical Details ### API Endpoint - **URL**: `https://api.bocha.cn/v1/web-search` - **Method**: POST - **Auth**: Bearer token in Authorization header

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script’s user-facing comments and prompts are written in Chinese throughout, including operational messages and required input prompts. For a general-purpose publish script, this imposes a specific language on the user without opt-in or any documented justification for a Chinese-only locale.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill is explicitly designed to communicate with an external search API, which means user-supplied queries and related metadata leave the local environment. In the context of an agent skill, this is security-relevant because operators may unknowingly expose sensitive prompts, research topics, or internal identifiers to a third party if outbound transmission is not made explicit and controlled.
Content: Scanner excerpt · scripts/bocha_search.js (reported line 16)May include surrounding context.
js
const { URL } = require('url'); // API Configuration const BOCHA_API_ENDPOINT = 'https://api.bocha.cn/v1/web-search'; // Colors for terminal output (optional) const colors = {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The tool sends the user's search query to a third-party service at api.bocha.cn, but the output and runtime behavior do not clearly warn users that their input is being transmitted off-box. This creates a privacy and data-handling risk, especially if users enter sensitive terms, credentials, internal project names, or regulated data assuming the search runs locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language description emphasizes Chinese-specific optimization (中文优化) and frames the skill primarily around Chinese usage. This may create a language/locale preference without explicit user opt-in or a documented reason that the skill is intentionally region- or language-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The file states users can ask in Chinese or English, but then says the skill will automatically route Chinese queries to this provider and repeatedly emphasizes Chinese-only optimization. This can amount to a language/locale preference baked into behavior without a clear opt-in or explicit user choice mechanism.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The returned text is hardcoded in Chinese and date formatting is explicitly forced to the 'zh-CN' locale. This is a natural-language policy concern because the skill imposes a specific language/locale on all users without opt-in, fallback, or documentation that it is intended only for Chinese-language contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description states the skill is "Optimized for Chinese content and queries," which expresses a language/locale preference in natural-language metadata without offering user choice or opt-in. Under the policy rule for language/locale constraints, this can be considered a mild policy violation because the skill does not explicitly present localization as optional or region-specific.
Content: No source excerpt is available for this finding.