Skill Trust Decision

search

Name: search Trust Review Report
Item: search
Rating: 45
Author: ClawSafe

Multi-engine search skill contains undeclared shell execution via api.exec() calling local Python scripts, hardcoded API credentials, and hardcoded Windows development paths - creating significant doc-to-code mismatch.

Install decision first Source: ClawHub Scanned: Jun 24, 2026

Files 9

Artifacts 7

Violations 1

Findings 4

Most direct threat evidence

Skill masquerades as a standard web search tool through SKILL.md Entry · SKILL.md

Executes local Python script via undeclared shell execution (api.exec()) Escalation · plugin.ts

Exposes hardcoded Tavily API key to local script via environment variable Escalation · plugin.ts

Why this conclusion was reached

2/4 dimensions flagged

Block

Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

7 lower-risk artifacts were extracted and still need context.

Block

Attack chain and severe findings

The report includes 3 attack-chain steps and 2 severe findings.

Review

Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

Attack Chain

Skill masquerades as a standard web search tool through SKILL.md

Entry · SKILL.md:1

Executes local Python script via undeclared shell execution (api.exec())

Escalation · plugin.ts:71

Exposes hardcoded Tavily API key to local script via environment variable

Escalation · plugin.ts:77

What drove the risk score up

Undeclared shell execution +25

plugin.ts uses api.exec() to run local Python script - not declared in SKILL.md

Hardcoded API key +20

Embedded Tavily API key found in providers/tavily.ts and plugin.ts

Windows development path exposure +10

Hardcoded path D:\winopenclaw\workspace\skills\_legacy\ indicates untested production code

Most important evidence

High Doc Mismatch

Undeclared shell execution via api.exec()

SKILL.md describes search using Tavily/multi/SearXNG APIs, but plugin.ts actually executes a local Python script via api.exec() at a hardcoded Windows path. This is a significant doc-to-code mismatch.

plugin.ts:71

Replace shell execution with direct HTTP API calls to Tavily, or fully document the shell execution requirement in SKILL.md with security rationale.

High Credential Theft

Hardcoded Tavily API key embedded in source

A Tavily API key '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' is hardcoded in both providers/tavily.ts and plugin.ts, serving as a fallback when TAVILY_API_KEY env var is not set.

providers/tavily.ts:10

Remove hardcoded API key entirely. Require users to provide their own TAVILY_API_KEY environment variable. Rotate the exposed key immediately.

Medium Doc Mismatch

Windows development path hardcoded in production code

The Python script path 'D:\winopenclaw\workspace\skills\_legacy\tavily\search_tavily_news.py' is a Windows absolute path indicating this code was never properly adapted for deployment.

plugin.ts:74

Remove hardcoded paths. If local script execution is necessary, use relative paths from a configurable skill directory.

Medium Doc Mismatch

Multi-engine implementation mismatch

The 'multi' engine has duplicate code paths in plugin.ts (lines 81-98 and 100-122) with inconsistent implementation - one uses api.exec() with the same Python script, the other uses web_fetch scraping.

plugin.ts:81

Consolidate multi-engine implementation to a single, documented approach.

Declared capability vs actual capability

Shell Block

Declared NONE

→

Inferred WRITE

plugin.ts:71-77 - api.exec() usage not declared in SKILL.md

Network Pass

Declared READ

→

Inferred READ

Tavily API and SearXNG local network calls documented

Suspicious artifacts and egress

Medium External URL

http://127.0.0.1:8080

plugin.ts:74

Medium External URL

https://www.baidu.com/s?wd=$

plugin.ts:147

Medium External URL

https://cn.bing.com/search?q=$

plugin.ts:148

Medium External URL

https://www.google.com/search?q=$

plugin.ts:149

Medium External URL

https://api.tavily.com/search

providers/tavily.ts:12

Medium External URL

https://clawhub.ai/user/hollisken

skill-card.md:7

Medium External URL

https://clawhub.ai/hollisken/kn70-search

skill-card.md:29

Dependencies and supply chain

There are no structured dependency warnings.

File composition

9 files · 507 lines

TypeScript 5 files · 389 linesMarkdown 2 files · 67 linesYAML 1 files · 46 linesJSON 1 files · 5 lines

Files of concern · 3

plugin.ts TypeScript · 201 lines

Undeclared shell execution via api.exec() · Windows development path hardcoded in production code · Multi-engine implementation mismatch · http://127.0.0.1:8080 · https://www.baidu.com/s?wd=$ · https://cn.bing.com/search?q=$ · https://www.google.com/search?q=$

skill-card.md Markdown · 42 lines

https://clawhub.ai/user/hollisken · https://clawhub.ai/hollisken/kn70-search

providers/tavily.ts TypeScript · 46 lines

Hardcoded Tavily API key embedded in source · https://api.tavily.com/search

Other files · skill.yaml · cache.ts · multi.ts · searxng.ts · SKILL.md · _meta.json

Security positives

skill-card.md acknowledges known risks including the embedded API key and undeclared script execution

Rate limiting implemented (20 calls/min) for Tavily API

Search caching implemented to reduce API calls

SearXNG connection falls back to Tavily on failure

No evidence of data exfiltration or C2 communication