Bug type

Behavior bug (incorrect output/state without crash)

Summary

Web search key presence audit is incomplete: hasWebSearchKey only check Perplexity and Brave, missing Gemini, Grok, and Kimi keys

Steps to reproduce

1. Configure only one of these keys: tools.web.search.gemini.apiKey, tools.web.search.grok.apiKey, or tools.web.search.kimi.apiKey.
2. Run the audit path that uses hasWebSearchKey (security audit extras).
3. Observe that the key is not recognized as present.

Expected behavior

hasWebSearchKey should return true when any configured web search provider key is present (Brave, Perplexity, Gemini, Grok, or Kimi).

Actual behavior

hasWebSearchKey only accounts for Brave + Perplexity, so Gemini/Grok/Kimi-only configurations are treated as if no web search key exists.

OpenClaw version

2026.3.2

Operating system

Debian 12

Install method

npm global

Logs, screenshots, and evidence

src/security/audit-extra.sync.ts shows this is the case

Impact and severity

Affected: users relying on Gemini/Grok/Kimi for web search + maintainers depending on audit signals
Severity: Medium (audit false negatives)
Frequency: 100% for configs using only missing providers
Consequence: incorrect audit output

Additional information

I do personally find it quite odd how the options outside of Perplexity and Brave exist, given that both of them handle/produce structured JSON data, while these others are grounded summaries. I believe they should be treated as skills or MCPs instead of web search, but that is a call for the maintainers to make, not me