Search Web - CN

Openclaw/Trae 联网搜索国内方案，使用火山引擎联网问答智能体 API 进行网络搜索问答。

Security Scan

The skill claims to call VolcEngine's agent API, but the code posts to an unrelated host (open.feedcoopapi.com) and the package metadata omits required environment variables — this mismatch could allow your API key and queries to be sent to an unknown service.

Purpose & Capability

The README/SKILL.md describe using VolcEngine's联网问答智能体 API and require VOLCENGINE_SEARCH_API_KEY and VOLCENGINE_SEARCH_BOT_ID, but the registry metadata lists no required env vars. The script sends requests to https://open.feedcoopapi.com/..., not an official volcengine.com endpoint — this is inconsistent with the stated purpose.

Instruction Scope

Instructions tell the agent to run the included script which reads environment variables for API keys and bot ID and then POSTs user questions to the external API_URL. The instructions do not disclose that the endpoint is open.feedcoopapi.com (an unknown third party), so running it will transmit queries, metadata, and the API key to that host.

Install Mechanism

No install spec (instruction-only + a small script). Nothing is written to disk by an installer; risk comes from network calls at runtime rather than package installation.

Credentials

The script requires secret values (VOLCENGINE_SEARCH_API_KEY or VOLCENGINE_ARK_API_KEY and VOLCENGINE_SEARCH_BOT_ID) which are reasonable for a VolcEngine integration — but the metadata omitted these required env vars and the target host is not the official service, creating a risk that credentials would be sent to an unrelated party.

Persistence & Privilege

The skill is not always-enabled and does not request system-wide persistence or modify other skills. Autonomous invocation is allowed by default (normal) but does not appear combined with elevated privileges.

Scan Findings in Context

[external_api_endpoint_mismatch] unexpected: SKILL.md and README claim VolcEngine API usage and link to volcengine.com docs, but the script posts to open.feedcoopapi.com, an unrelated domain; this is not expected for a direct VolcEngine integration.

[metadata_missing_required_env] unexpected: Registry metadata lists no required env vars while README and SKILL.md state VOLCENGINE_SEARCH_API_KEY and VOLCENGINE_SEARCH_BOT_ID are required. The runtime script also reads these env vars — metadata omission is incoherent and reduces transparency.

What to consider before installing

Do not provide your VolcEngine API key or bot ID to this skill until you resolve the endpoint and provenance questions. Specifically: 1) Verify the target host (open.feedcoopapi.com) — is it an approved proxy or your organization's gateway? 2) Ask the author for the reason the script does not call an official volcengine.com endpoint and for publisher contact/provenance. 3) Prefer using official VolcEngine SDKs/endpoints or run the script in an isolated environment and inspect outbound traffic (e.g., with a network proxy) before using real credentials. 4) If you must test, create a scoped/throwaway API key with minimal permissions. The mismatches between code, docs, and metadata are a red flag; proceed only after confirming the destination service is trusted.

Volcengine Search Web Skill - 联网搜索国内方案

专为 Openclaw、Trae 等 AI 编程工具设计的联网搜索国内解决方案。

免责声明：本项目为个人开发代码，与火山引擎官方无关，仅供学习参考使用。

适用场景

当 Openclaw、Trae 等工具需要联网搜索信息时，可使用此技能作为国内方案替代 Brave Search。支持搜索网络、获取参考资料、富媒体卡片数据，实现追问、引用角标、图文混排、百科划线词等高级功能。

为什么选择此方案？

• 无需绑定信用卡 - 国内支付方式即可开通
• 访问稳定 - 国内服务器，响应速度快
• 中文搜索优化 - 更懂中文语境，搜索结果更精准

使用步骤

1. 准备清晰具体的问题。
2. 运行脚本 python scripts/volcengine_search_web.py "<question>"。运行之前cd到对应的目录。
3. 脚本将返回智能体的回答内容，包括参考来源、追问建议等。

认证与凭据来源

• 读取 VOLCENGINE_SEARCH_API_KEY 环境变量作为 API Key。
• 需要配置 VOLCENGINE_SEARCH_BOT_ID 环境变量指定智能体ID（在控制台创建智能体后获取）。

输出格式

• 输出智能体的回答内容。
• 显示参考来源（URL、标题、发布时间等）。
• 显示追问建议（如有）。
• 显示 Token 使用情况。
• 若调用失败，将打印错误信息。

示例

python scripts/volcengine_search_web.py "openclaw的最新动态"

高级功能

该技能支持以下高级功能（需在控制台开启）：

• 引用角标：在回答中插入引用标记 [ref_x] 指示文本来源
• 图文/视频混排：在输出中穿插图片或视频
• 百科划线词：自动将百科词条以下划线超链接形式呈现
• 追问建议：提供相关追问建议
• 深度思考模式：通过设置 model=thinking 开启