安全决策报告
search
Multi-engine search skill contains undeclared shell execution via api.exec() calling local Python scripts, hardcoded API credentials, and hardcoded Windows development paths - creating significant doc-to-code mismatch.
最直接的威胁证据
01
Skill masquerades as a standard web search tool through SKILL.md 初始入口 · SKILL.md
02
Executes local Python script via undeclared shell execution (api.exec()) 权限提升 · plugin.ts
03
Exposes hardcoded Tavily API key to local script via environment variable 权限提升 · plugin.ts
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 7 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 3 步攻击链，另有 2 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
攻击链
01
Skill masquerades as a standard web search tool through SKILL.md
初始入口 · SKILL.md:1
02
Executes local Python script via undeclared shell execution (api.exec())
权限提升 · plugin.ts:71
03
Exposes hardcoded Tavily API key to local script via environment variable
权限提升 · plugin.ts:77
风险分是怎么被拉高的
Undeclared shell execution +25
plugin.ts uses api.exec() to run local Python script - not declared in SKILL.md
Hardcoded API key +20
Embedded Tavily API key found in providers/tavily.ts and plugin.ts
Windows development path exposure +10
Hardcoded path D:\winopenclaw\workspace\skills\_legacy\ indicates untested production code
最关键的证据
高危 文档欺骗
Undeclared shell execution via api.exec()
SKILL.md describes search using Tavily/multi/SearXNG APIs, but plugin.ts actually executes a local Python script via api.exec() at a hardcoded Windows path. This is a significant doc-to-code mismatch.
plugin.ts:71 Replace shell execution with direct HTTP API calls to Tavily, or fully document the shell execution requirement in SKILL.md with security rationale.
高危 凭证窃取
Hardcoded Tavily API key embedded in source
A Tavily API key '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' is hardcoded in both providers/tavily.ts and plugin.ts, serving as a fallback when TAVILY_API_KEY env var is not set.
providers/tavily.ts:10 Remove hardcoded API key entirely. Require users to provide their own TAVILY_API_KEY environment variable. Rotate the exposed key immediately.
中危 文档欺骗
Windows development path hardcoded in production code
The Python script path 'D:\winopenclaw\workspace\skills\_legacy\tavily\search_tavily_news.py' is a Windows absolute path indicating this code was never properly adapted for deployment.
plugin.ts:74 Remove hardcoded paths. If local script execution is necessary, use relative paths from a configurable skill directory.
中危 文档欺骗
Multi-engine implementation mismatch
The 'multi' engine has duplicate code paths in plugin.ts (lines 81-98 and 100-122) with inconsistent implementation - one uses api.exec() with the same Python script, the other uses web_fetch scraping.
plugin.ts:81 Consolidate multi-engine implementation to a single, documented approach.
声明能力 vs 实际能力
命令执行 阻止
声明 NONE
→ 推断 WRITE
plugin.ts:71-77 - api.exec() usage not declared in SKILL.md 网络访问 通过
声明 READ
→ 推断 READ
Tavily API and SearXNG local network calls documented 可疑产物与外联
中危 外部 URL
http://127.0.0.1:8080 plugin.ts:74
中危 外部 URL
https://www.baidu.com/s?wd=$ plugin.ts:147
中危 外部 URL
https://cn.bing.com/search?q=$ plugin.ts:148
中危 外部 URL
https://www.google.com/search?q=$ plugin.ts:149
中危 外部 URL
https://api.tavily.com/search providers/tavily.ts:12
中危 外部 URL
https://clawhub.ai/user/hollisken skill-card.md:7
中危 外部 URL
https://clawhub.ai/hollisken/kn70-search skill-card.md:29
依赖与供应链
没有结构化依赖告警。
文件构成
9 个文件 · 507 行
TypeScript 5 个文件 · 389 行Markdown 2 个文件 · 67 行YAML 1 个文件 · 46 行JSON 1 个文件 · 5 行
需关注文件 · 3
plugin.ts Undeclared shell execution via api.exec() · Windows development path hardcoded in production code · Multi-engine implementation mismatch · http://127.0.0.1:8080 · https://www.baidu.com/s?wd=$ · https://cn.bing.com/search?q=$ · https://www.google.com/search?q=$
skill-card.md https://clawhub.ai/user/hollisken · https://clawhub.ai/hollisken/kn70-search
providers/tavily.ts Hardcoded Tavily API key embedded in source · https://api.tavily.com/search
其他文件 · skill.yaml · cache.ts · multi.ts · searxng.ts · SKILL.md · _meta.json
安全亮点
skill-card.md acknowledges known risks including the embedded API key and undeclared script execution
Rate limiting implemented (20 calls/min) for Tavily API
Search caching implemented to reduce API calls
SearXNG connection falls back to Tavily on failure
No evidence of data exfiltration or C2 communication