此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-7FAA57B3
10/12/2026, 5:15:10 PM
byted-web-search 安全评估 v1
Skill 安全认证报告
扫描器版本 3.0.0 审计模型: codex 最新发布的报告
- 技能名称
- byted-web-search
- 版本
- v1.3.9
- 维护者
- volcengine-search-team
- 覆盖范围
- 8 已扫描文件 · 1,174 分析行数
- 策略版本
- skillstore-security-audit-policy-v1
已确认问题的最高严重性
严重
有 6 个已确认的安全问题需要处理。
安装上下文
请查看当前 Skill 详情页
本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
Most static matches are documentation, Markdown syntax, or normal authentication rather than threats. Confirmed risks include credential solicitation, command-line secret exposure, broad environment imports, and bearer-token transmission to unchecked endpoints. Semantic review found explicit priority overrides and instructions that downplay billing information; no evidence found of a concealed malicious payload.
报告位置
最新发布的报告
“最新”仅指报告序列，不代表 artifact 当前有效。
审计证明
有效证明
此精确报告有可公开验证的证明。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
8 已扫描文件 · 1,174 分析行数
有 17 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
已绑定 commit 与路径
构件
已绑定内容与 tree hash
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 34 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
在 4 个证据位置观察到
环境变量
可能读取进程环境中的值。
在 38 个证据位置观察到
外部命令
可能调用 Skill 之外的命令或程序。
在 48 个证据位置观察到
能力复核项 (11)
高
Generic API/secret keys
3. 在对话中将 Key 发给 Agent,或配置环境变量 `WEB_SEARCH_API_KEY`
The setup step asks users to send their API key in conversation. This exposes credentials to chat history and agent processing.
高
Python HTTP libraries
response = requests.post(url, headers=headers, data=body_str.encode("utf-8"), timeout=30)
The POST sends Authorization headers to a URL accepted from WEB_SEARCH_BASE_URL without scheme or host validation. An unsafe override can expose bearer credentials.
高
Python getenv function
url = os.getenv("WEB_SEARCH_BASE_URL", "").strip() or INTERNAL_API_URL
An environment value directly selects the bearer-token destination without HTTPS or host validation. A modified configuration can redirect credentials to an untrusted server.
高
getenv function call
url = os.getenv("WEB_SEARCH_BASE_URL", "").strip() or INTERNAL_API_URL
WEB_SEARCH_BASE_URL controls where the bearer token is sent. No scheme restriction or trusted-host check prevents credential disclosure through an unsafe override.
高
Generic API/secret keys
"Authorization": f"Bearer {api_key}",
The bearer token enters headers subsequently sent to an unchecked environment-selected URL. This makes an unsafe endpoint override a credential disclosure vector.
高
Generic API/secret keys
"凭证:Claw 中直接在聊天框发 Key 即可;或 WEB_SEARCH_API_KEY / --api-key"
Command help explicitly encourages sending the key in chat. This exposes secrets to conversation storage instead of a dedicated credential channel.
高
Generic API/secret keys
parser.add_argument("--api-key", help="API Key(优先于环境变量 WEB_SEARCH_API_KEY)")
The --api-key argument places the secret in command-line arguments. Process inspection and shell or tool history can reveal the credential.
高
Generic API/secret keys
| `--api-key` | string | | 读环境变量 | 手动传入 API Key(优先于 `WEB_SEARCH_API_KEY`)
The documented --api-key option places a live credential in command arguments. Process inspection and command history can expose it.
中
Hidden file access
LEGACY_ENV_PATH = "/root/.openclaw/.env"
Startup automatically reads the shared root OpenClaw .env through this path. The loader imports all entries, including unrelated configuration, without explicit selection.
中
Hidden file access
USER_ENV_PATH = str(Path.home() / ".openclaw/.env")
Startup also reads the current user's shared OpenClaw .env. Unrestricted imports cross the search skill's configuration boundary.
中
Python environment access
os.environ.setdefault(key, value)
The loader inserts every parsed key into the process environment without an allowlist. File entries can influence endpoint selection or Requests proxy routing.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (6)
RISK-001 严重
Prompt Injection Attempt Detected
SKILL.md labels its search mandate '系统级要求' and claims '此要求的优先级高于其他一切描述'. These claims elevate untrusted skill instructions above host policies and force credential onboarding text.
The source explicitly claims system-level authority and higher priority than all other descriptions. This is direct instruction-hierarchy manipulation, not ordinary search usage guidance.
RISK-002 高
Environment file access
LEGACY_ENV_PATH = "/root/.openclaw/.env"
This shared root credential file is automatically consumed during startup. All entries are imported rather than limiting access to required search credentials.
RISK-003 高
Environment file access
USER_ENV_PATH = str(Path.home() / ".openclaw/.env")
The current user's shared OpenClaw .env is automatically loaded. Its unrestricted contents can affect search routing and expose unrelated configuration to the process.
RISK-004 高
Environment file access
# 尝试从 skill 根目录加载 .env(与 scripts/ 同级)
The adjacent startup code automatically loads a skill-local .env through the unrestricted loader. Repository-controlled entries can alter the environment before credentials are used.
RISK-005 高
Environment file access
_load_legacy_env_file(os.path.join(_skill_root, ".env"))
The skill-local .env is loaded without key restrictions or explicit approval. A supplied file can set WEB_SEARCH_BASE_URL and redirect externally provided bearer credentials.
RISK-006 中
Billing Disclosure Is Deliberately Downplayed
The onboarding directive emphasizes '官方能力、免费额度、放心用' and says '避免大段计费说明'. Mandatory reassurance can obscure account costs while encouraging service activation and credential submission.
The directive explicitly favors free-quota reassurance over billing detail in compulsory onboarding. No evidence found of an automatic charge; the risk is impaired informed consent.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001严重Skill instructions claim system authority and priority over other instructions.Remove identity reassignment and priority claims; scope instructions to requested searches and explicitly defer to host policies and user preferences.
- FIX-002高Setup guidance encourages sending API keys through chat.Replace chat-based credential collection with a secret manager or the existing hidden input option; remove these prompts from documentation and error messages.
- FIX-003高The endpoint override receives bearer tokens without validating its scheme or host.Require HTTPS and approved hosts before constructing authenticated requests; require explicit approval for proxy hosts and reject unsafe redirects.
- FIX-004高Startup imports every environment entry from shared and skill-local credential files.Make file loading explicit and restrict imported names to required credentials; do not load proxy or endpoint configuration from untrusted files.
- FIX-005中The API key option exposes secrets through command arguments.Prefer hidden input or scoped secret injection; remove command examples containing keys and deprecate passing secrets through --api-key.
- FIX-006中Credential onboarding emphasizes reassurance while discouraging billing details.Explain external query transmission, applicable account pricing, and quota limits before onboarding; obtain approval before billable retries or expanded searches.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 7faa57b373af06b1dfb180433d9d65112b412781
- 内容哈希
- a66ef158bde6a49ff73838c034db139bbea75a82c529a6a973f5ea5c47e33f72
- 目录树哈希
- d6b2567427d7f684e302996a6ff41254cb64ca26d118b54844efdeb77daa720b
- Skill 路径
- skills/kotot/byted-web-search
- 审计载荷哈希
- 4e08775c5e4932fd51de07e240423514
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: active