Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Turing Baidu Web Search
v1.0.0Search the web via the Turing Baidu proxy. Use when the user asks to search the web in Chinese, look up real-time information from Chinese sources, research...
⭐ 0· 198·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and scripts.py both require TURING_API_KEY, TURING_CLIENT, and TURING_ENVIRONMENT and call a Turing Baidu proxy endpoint — that matches the declared purpose. However, the registry metadata (top-level requirements) lists no required env vars or primary credential, creating an incoherence between what the skill actually needs and what the registry advertises.
Instruction Scope
Runtime instructions are narrowly scoped: run the bundled script with a JSON argument and supply Turing credentials via openclaw.json. The script only reads ~/.openclaw/openclaw.json for its config and does HTTP POSTs to the declared Turing proxy endpoint. It does not access other system files or network endpoints. The only scope oddity is that SKILL.md says 'do NOT construct HTTP requests manually' and mandates using the bundled script — reasonable but restrictive.
Install Mechanism
No install spec or remote downloads; the skill is instruction + a small local Python script. There is no external installer or archive extraction, which is low-risk.
Credentials
The credentials requested in SKILL.md and scripts.py (TURING_API_KEY, TURING_CLIENT, TURING_ENVIRONMENT, optional TURING_API_BASE) are proportional to a proxy search API. Concern arises because the registry metadata does not declare these required credentials, and the script expects them in ~/.openclaw/openclaw.json rather than (or in addition to) process environment — this mismatch could surprise users and lead to misplaced secrets. No unrelated secrets are requested.
Persistence & Privilege
always:false (default) and the skill does not modify other skills or system-wide settings. Autonomous invocation (disable-model-invocation:false) is the platform default; combined with credential access this increases blast radius but is expected for a web-search skill.
What to consider before installing
This skill's code and README legitimately call a Turing Baidu proxy and need three Turing credentials. However, the registry metadata incorrectly lists no required credentials — that mismatch is the main red flag. Before installing: verify the skill owner/source (homepage is docs.turing.cn but owner is unknown), confirm where you will store the TURING_API_KEY/CLIENT/ENV (the script reads ~/.openclaw/openclaw.json), and ensure those tokens are scoped and revocable. Consider testing in a sandbox with a limited-scope test key first. If you rely on the registry entry, ask the publisher to correct the advertised required env vars so the permissions are explicit. If you do not trust the owner, do not provide production credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk972rpsrbydh1sm38h01tqe1as82vb5q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔍 Clawdis