Felo Search
v1.0.0Felo AI real-time web search for questions requiring current/live information. Triggers on current events, news, trends, real-time data, information queries,...
⭐ 0· 275·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes a real-time web/search integration with Felo (calls to https://openapi.felo.ai/v2/chat) which is coherent with the skill name and description. However, the registry metadata declares no required credentials or primary credential while the instructions explicitly require a FELO_API_KEY environment variable—this inconsistency suggests the metadata is incomplete or incorrect.
Instruction Scope
Instructions are limited to checking an env var, writing a temporary JSON to /tmp, calling the Felo API via curl, parsing the JSON, and deleting the temp file. That scope is appropriate for a search API. Points to note: the SKILL.md expects the agent to run shell commands (Bash tool) and to substitute user queries into a heredoc; the heredoc usage is quoted (safer against shell expansion), but any user-provided content included in requests should not contain sensitive data because it will be transmitted to an external service.
Install Mechanism
No install spec and no code files are present, so nothing is written to disk beyond the temporary query file created at runtime. This is the lower-risk pattern for a connector skill.
Credentials
The instructions require FELO_API_KEY and show how to set it, but the skill metadata lists no required environment variables or primary credential. Requiring a bearer API key to call an external API is reasonable, but the missing declaration in metadata is a mismatch and a governance gap. Also: there is no guidance about the API key scope, expiry, or minimum permissions; the instructions encourage placing the key in persistent shell profiles which could increase exposure.
Persistence & Privilege
The skill does not request always:true, has no install actions, and does not modify other skills or system-wide settings. It only instructs runtime use of Bash and temporary files, which is within expected bounds for this type of skill.
What to consider before installing
This skill appears to be a straightforward connector to Felo's public API, but the registry metadata omits the FELO_API_KEY that the runtime instructions require—treat that as an inconsistency. Before installing: 1) Confirm you trust the source (there's no homepage or verified owner info). 2) Only provide an API key you control and revoke it if you stop using the skill; prefer a key with minimal scope. 3) Don't send sensitive or private data in queries (they are transmitted to https://openapi.felo.ai). 4) If you manage a registry, ask the publisher to update metadata to declare FELO_API_KEY as a required credential and to provide provenance (homepage, owner contact). If you can't verify the publisher or are uncomfortable with the missing metadata, avoid enabling the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk971ykzhd6j8vmfzrewkqgbn3182cb16
License
MIT-0
Free to use, modify, and redistribute. No attribution required.