Pansxng Websearch

自包含的本地元搜索引擎技能。基于 SearXNG，零配置，开箱即用。 触发词：搜索、搜一下、pansxng、联网搜索、私密搜索、searx、帮我搜、xxx是什么。 使用场景：(1) 联网搜索 (2) 多引擎聚合 (3) 隐私搜索 (4) 指定引擎搜索 无需任何前置条件——首次使用时自动安装全部依赖（Homebre...

Security Scan

The skill appears to be what it claims—a self-contained local SearXNG-based search helper that auto-installs and runs a local search service—but it performs intrusive system installs and persistent modifications that you should review before use.

Purpose & Capability

The name and description promise a self-contained local meta-search based on SearXNG. The script clones SearXNG, installs Python/Homebrew/Valkey via Homebrew, configures and launches a local webapp on 127.0.0.1:8888—these requirements are coherent with the stated purpose.

Instruction Scope

SKILL.md and scripts instruct the agent to auto-install system components, clone from GitHub, write configuration files, and start background services. This is consistent with a 'zero-config' local server, but the instructions perform system-wide changes (installing Homebrew, adding lines to ~/.zshrc, creating ~/Downloads/searxng, starting daemons) that are intrusive and persistent.

Install Mechanism

There is no packaged install spec; the script runs standard network installs: curling the official Homebrew install script (raw.githubusercontent.com), running brew installs, pip installs, and git clone from github.com/searxng/searxng. These are expected for installing SearXNG but carry the usual risks of executing remote install scripts and writing files to disk.

Credentials

The skill does not request credentials or environment variables. It sets a fixed local secret_key in SearXNG configuration (hard-coded 'pans-searxng-2024'), which is functional but insecure; no unexplained credential access is requested.

Persistence & Privilege

The skill starts long-running services (valkey-server, searx webapp), writes logs to /tmp/searxng.log, clones into ~/Downloads/searxng, and appends a PATH line to ~/.zshrc. It does not set always:true, but it does create persistent changes to the user's environment.

Assessment

This skill legitimately installs and runs a local SearXNG instance, but it will: (1) download and execute remote install scripts (Homebrew via raw.githubusercontent.com), (2) clone a GitHub repo and pip-install requirements, (3) modify your shell rc (~/.zshrc), (4) create ~/Downloads/searxng and /tmp/searxng.log, and (5) start background services (valkey, searx). If you intend to use it, review the script source, back up ~/.zshrc, and consider running it in an isolated environment (VM or container). If you prefer more control, run the script manually (use the provided --install/--start options) instead of allowing automatic installs. Note the hard-coded SearXNG secret_key — rotate or change it if you expose any interfaces beyond localhost.

基于 SearXNG 开源项目的完全自包含元搜索引擎。 零手动配置——首次使用时自动安装所有依赖，后续自动启动。

使用方式

直接说：

• "帮我搜 xxx"
• "搜索 xxx 是什么"
• "搜一下深圳天气"

自动安装链

首次搜索
  ├─ Homebrew 缺失？→ 自动安装
  ├─ Python 3.11 缺失？→ 自动安装
  ├─ Valkey 缺失？→ 自动安装
  └─ SearXNG 缺失？→ 自动克隆 + 安装依赖 + 配置
  → 启动 → 搜索 ✅

搜索脚本

路径：scripts/search.py

# 搜索
python3 scripts/search.py "关键词" [选项]

# 选项
--lang, -l     语言 (默认 zh-CN)
--count, -n    结果数量 (默认 10)
--json, -j     输出原始 JSON
--engines, -e  指定引擎 (逗号分隔，如 baidu,bing,sogou)
--categories, -c  分类: general, images, videos, news, it, science

# 管理
--status       查看完整状态
--install      手动触发安装
--start        手动启动
--stop         停止服务

回退机制

脚本返回 JSON 包含 "fallback": true 时，OpenClaw 自动回退到内置 web_search 工具。 确保任何情况下都有搜索结果。

国内可用引擎

• ✅ 百度 (baidu) — 推荐国内搜索
• ✅ 搜狗 (sogou)
• ✅ 360搜索 (360search)
• ✅ Bing
• ⚠️ Google / DuckDuckGo — 国内可能超时

隐私

所有搜索请求通过本地 SearXNG 实例发出，无法追踪真实 IP。