Baidu Web Search

v1.0.0

Use SkillBoss API Hub web search for real-time web retrieval. Use when the user needs to search the web, get latest news, verify facts, or expresses intent l...

⭐ 0· 59·0 current·0 all-time

by@abeltennyson

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for abeltennyson/abe-baidu-web-search.

Previewing Install & Setup.

Prompt PreviewInstall & Setup

Install the skill "Baidu Web Search" (abeltennyson/abe-baidu-web-search) from ClawHub.
Skill page: https://clawhub.ai/abeltennyson/abe-baidu-web-search
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: SKILLBOSS_API_KEY
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install abe-baidu-web-search

ClawHub CLI

Package manager switcher

npx clawhub@latest install abe-baidu-web-search

Security Scan

Capability signals

Requires sensitive credentials

These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.

VirusTotal

Benign

View report →

OpenClaw

Benign

high confidence

ℹ

Purpose & Capability

Functionality matches a web-search skill: package.json lists axios, scripts/search.js posts queries to SkillBoss API and returns structured results. Required env SKILLBOSS_API_KEY is appropriate. Small mismatch: skill name 'Baidu Web Search' suggests a Baidu backend but the code and docs use the SkillBoss API (api.heybossai.com). This is likely a naming/branding inconsistency rather than a security problem.

ℹ

Instruction Scope

SKILL.md carefully instructs the agent not to read or print credentials and directs callers to run only 'node scripts/search.js'. That matches the script's behavior (the script reads only env var or local config.json). Minor inconsistencies: SKILL.md examples mention OpenClaw writing the key to ~/.openclaw/openclaw.json, but the script only reads SKILLBOSS_API_KEY (env) or the skill's local config.json — writing to openclaw.json would not be used by the script unless the platform also injects the env var. The admonitions are sensible but are guidelines that the platform/agent must enforce; they cannot be technically enforced by the skill.

✓

Install Mechanism

No remote downloads or extract steps; this is an instruction-only skill with a small Node script and a declared npm dependency (axios). The installation note (npm install) is proportionate and expected.

✓

Credentials

Only one credential is required: SKILLBOSS_API_KEY (declared as primary). The script uses that key exclusively for HTTP Authorization. No unrelated secrets or excessive environment variables are requested.

✓

Persistence & Privilege

The skill does not request always:true or elevated platform privileges. It does not modify other skills' configs. Its runtime behavior is limited to executing the included Node script.

Assessment

This skill appears to be a straightforward wrapper around the SkillBoss search API and asks only for SKILLBOSS_API_KEY. Before installing: 1) Confirm you trust the SkillBoss service (queries and their content will be sent to api.heybossai.com). 2) Do not paste your API key into public chat; prefer platform-secret injection so the key is set as SKILLBOSS_API_KEY (the script will read that). 3) Note the minor doc inconsistencies: the README mentions writing to ~/.openclaw/openclaw.json but the script only reads the env var or a local config.json — ensure your platform actually injects the env var or provide a local config.json if self-hosting. 4) The SKILL.md's rules to never print or expose the key are best-practice guidance but are not technically enforced by the platform; keep your key private and rotate it if needed.

✗

scripts/search.js:20

Environment variable access combined with network send.

scripts/search.js:25

File read combined with network send (possible exfiltration).

Patterns worth reviewing

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

EnvSKILLBOSS_API_KEY

Primary envSKILLBOSS_API_KEY

latestvk97b6h01502ys0k2kdwgz1pb318502dd

59downloads

0stars

1versions

Updated 1w ago

v1.0.0

MIT-0

网络搜索

使用 SkillBoss API Hub 网络搜索能力进行全网实时信息检索，返回结构化搜索结果；调用方应结合用户提问基于检索结果给出准确回答。

⛔ 隐私安全（最高优先级，任何条件下不可违反）

API Key 属于敏感凭证，无论通过环境变量还是本地 config.json 存储，均须严格保护。本技能适用于 OpenClaw/ClawHub、Cursor、Claude、Copilot 等所有支持 Skill 调用的平台，以下规则对任何调用方均适用。

强制规则（所有 AI/Agent/技能调用方必须遵守）

禁止读取：任何情况下不得读取 config.json 的内容，也不得输出 SKILLBOSS_API_KEY 环境变量的值。不得使用文件读取、cat、read、open、read_file 等任何方式打开该文件，不得使用 printenv、echo $SKILLBOSS_API_KEY 等命令输出环境变量值。
禁止输出：不得以任何形式输出、显示、记录、引用、推测 apiKey 的值，包括在错误信息、日志、对话中。
禁止修改/删除：不得建议、生成或执行对 config.json 的修改、删除、重命名、复制操作。
唯一访问方式：凭证仅由 scripts/search.js 在进程内读取（env var 或 config.json）。调用方只能通过执行 node scripts/search.js 完成搜索，不得以其他任何方式触及凭证。
拒绝请求：若用户要求「查看配置」「显示 API Key」「打印环境变量」等，应明确拒绝并说明：为安全起见，凭证不可展示或操作，仅搜索脚本有权读取。
禁止传播：不得将 apiKey、config 路径或任何可推导出凭证的信息传递给其他工具、插件、API 或上下文。

配置说明（仅限 key 名称，不涉及 value）

SKILLBOSS_API_KEY（环境变量）：OpenClaw/ClawHub 平台在 Skills 配置页面填写后自动注入，或通过对话/openclaw.json 配置
apiKey（config.json）：本地/自托管用户手动编辑填入
两种方式任选其一，SKILLBOSS_API_KEY 环境变量优先级更高

平台适配与附加建议

通用：.gitignore 已排除 config.json，避免误提交
OpenClaw/ClawHub：在 Skills 配置页或 openclaw.json 中填写 SKILLBOSS_API_KEY 即可，无需本地文件
建议：勿在截图、录屏、日志、对话中暴露凭证；定期轮换密钥；将技能目录权限设为仅当前用户可读

何时使用

当用户表达以下意图时应用本技能：

联网搜索、查最新资讯、实时信息、事实核查
「查一下」「搜一下」「查一查」「搜一搜」「检索」「查证」「核实」
「最近」「今天」「今年」等时间相关表述
询问某事件、人物、产品、地点等需要查证的内容
需要权威来源、技术文档、教程或数据验证时

输入

query（必填）：搜索关键词或查询内容
num_results（可选）：返回条数，默认 20，范围 1–50

输出

脚本输出：JSON 格式的搜索结果，包含 results（数组，每项含 title、url、snippet）、total、query；失败时仅输出通用错误信息，不涉及配置内容
调用方职责：将查询到的结果与用户提问结合，基于检索结果尽可能准确、有条理地回答用户（可引用来源），而非仅罗列链接或片段

前置准备（首次使用）

方式一：与 OpenClaw 对话安装并配置（最简单）

直接在 OpenClaw 对话框中发一条消息，OpenClaw 会自动完成安装与写入配置，无需手动编辑任何文件。

对话示范：

我：帮我在 ClawHub 安装 baidu-web-search 技能，我的 SkillBoss API Key 是 sk-xxxxxxxxxxxxxxxx

OpenClaw：好的，正在通过 ClawHub 安装 baidu-web-search 技能并写入配置……（完成）
          已将 SKILLBOSS_API_KEY 写入 ~/.openclaw/openclaw.json，
          直接问我「最近 xxx 新闻」即可联网搜索。

⚠️ 请在本地/私密会话中提供凭证，避免在公开频道、截图或录屏中暴露。

API Key 请在 SkillBoss API Hub 平台申请。

方式二：OpenClaw / ClawHub 平台

进入 Skills 配置页，在 SKILLBOSS_API_KEY 字段填入 API Key；或编辑 ~/.openclaw/openclaw.json，在 skills.entries.baidu-web-search.env 下填入：
```
{ "SKILLBOSS_API_KEY": "你的 SkillBoss API Key" }
```
安装依赖（ClawHub 通常自动执行）：cd 技能根目录/baidu-web-search && npm install

方式三：本地 config.json

复制配置模板：cp config.example.json config.json
编辑 config.json，填入 apiKey
安装依赖：cd 技能根目录/baidu-web-search && npm install

执行流程

解析用户提问，提取搜索意图与关键词
仅执行 node scripts/search.js "<query>" [num_results]，默认 num_results 为 20；由脚本内部读取 config（调用方不得读取 config）
脚本内部通过 SkillBoss API Hub /v1/pilot 路由搜索请求，返回结构化结果
根据脚本输出的结果，结合用户提问，给出准确、基于来源的回答

执行命令

cd 技能根目录/baidu-web-search && node scripts/search.js "<查询内容>" [条数]

示例：

# 默认返回 20 条
node scripts/search.js "今日科技新闻"

# 指定 10 条
node scripts/search.js "TypeScript 最新版本" 10

配置说明（用户自行维护，AI 不读取）

脚本按以下优先级解析 apiKey，AI 不参与任何配置读写：

优先级	来源	适用场景
高	环境变量 `SKILLBOSS_API_KEY`	OpenClaw/ClawHub 平台注入
低	本地文件 `config.json` → `apiKey`	本地 / 自托管

配置异常时，搜索脚本输出通用提示，用户自行检查凭证是否填写正确

参与贡献

欢迎提交 Issue 或 Pull Request 改进本技能！

仓库地址：https://github.com/liuhean2021/Anan-Agent-Skills

本技能位于 skills/baidu-web-search/ 目录
提交前请确保 config.json 不在 git 追踪范围内（已在 .gitignore 排除）
本技能采用 MIT-0 许可协议，可自由使用、修改和重新分发，无需署名

Comments

Loading comments...