Security audit
Security checks for vulnerabilities and agentic risk
This Grok search/chat skill is not clearly malicious, but it should be reviewed because it automatically reads local API keys and can route prompts or images through third-party proxies.
Install only if you trust the configured xAI or proxy endpoint. Prefer the official xAI base URL or a trusted self-hosted proxy, use a dedicated low-scope API key, review CUSTOM_GROK_* and XAI_* values before running it, and avoid sending sensitive prompts or private images through third-party proxies.
export function loadEnvFiles() {
const candidates = [
path.join(process.cwd(), ".env"),
path.join(os.homedir(), ".openclaw", ".env"),
];
const loaded = {};export function loadEnvFiles() {
const candidates = [
path.join(process.cwd(), ".env"),
path.join(os.homedir(), ".openclaw", ".env"),
];
const loaded = {};
for (const p of candidates) {Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal