Is bartoszpijet/zai-search safe?
Yes. bartoszpijet/zai-search is safe to install. Oathe's behavioral security audit gave the zai-search skill by bartoszpijet a trust score of 85/100 with 2 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/bartoszpijet/zai-search
Is bartoszpijet/zai-search safe to install?
This appears to be a legitimate web search skill that uses the Z.AI Web Search API. The main security concern is the presence of executable JavaScript files whose source code could not be fully verified during the audit.
What security issues were found in bartoszpijet/zai-search?
Category Scores
Findings (2)
MEDIUM Executable JavaScript files present -30 ▶
The skill contains two executable Node.js scripts (search.mjs and extract.mjs) that are invoked by the skill documentation. While the functionality appears legitimate for web search operations, the actual source code of these scripts was not fully provided in the audit evidence, preventing complete verification of their safety.
LOW Extract script uses native fetch -10 ▶
The extract functionality uses native Node.js fetch to retrieve and parse web pages, which could potentially be misused to access internal URLs or services if an attacker could control the input URL.
Should I install bartoszpijet/zai-search?
Oathe's verdict for bartoszpijet/zai-search is SAFE with a trust score of 85/100. Recommendation: Install with caution.