Z.AI Web Search

AI-optimized web search via Z.AI Web Search API. Returns structured results (title, URL, summary) for LLM processing.

This skill appears to do what it says: it posts search requests to api.z.ai using ZAI_API_KEY and provides a basic HTML extractor. Before installing, consider: (1) Only provide an API key you control and can rotate; treat it as sensitive. (2) If you run agents in environments with access to internal networks or metadata services, be aware that the extract script can fetch arbitrary URLs — run in a network-restricted/isolated environment if you’re concerned. (3) Source is listed as unknown; if you need higher assurance, verify the publisher (owner ID) or inspect the included scripts yourself (they are short and readable). Rotate or revoke the key if you stop using the skill.

Type: OpenClaw Skill Name: zai-search Version: 1.0.0 The `scripts/extract.mjs` file is vulnerable to Server-Side Request Forgery (SSRF). It fetches content from arbitrary URLs provided as input without sufficient validation or restriction, allowing an attacker to potentially access internal network resources, cloud metadata endpoints, or other sensitive services from the agent's host. While this is a significant vulnerability, there is no clear evidence of intentional malicious behavior (e.g., exfiltration to an attacker-controlled domain, persistence, or obfuscation), classifying it as suspicious rather than malicious. Other files are benign.