ClawHub

小宿智能搜索

v1.0.2

Web search via 小宿智能搜索 V2 API (XiaoSu Smart Search). Use when internet search, web lookup, real-time information retrieval, news search, or fact-checking is n...

⭐ 0· 115·0 current·0 all-time
by@dr-xiaoming
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, SKILL.md, and the included Python script all implement a web-search client for the same API. The declared credentials (access key and endpoint) are appropriate for an external search API.
✓
Instruction Scope
Runtime instructions only describe setting two env vars and running the script or curl against the documented API. The instructions do not ask the agent to read unrelated files, secrets, or system config.
✓
Install Mechanism
There is no install spec; the skill is instruction-only plus a small Python script that uses only standard libraries. Nothing is downloaded from external/obscure URLs or written to nonstandard locations.
✓
Credentials
The skill requests exactly two values (XIAOSU_AK and XIAOSU_ENDPOINT) which are necessary to authenticate to the XiaoSu search API. No unrelated credentials or high-privilege env vars are requested.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges or modify other skills. Autonomous invocation is allowed (platform default) and is not combined with other red flags.
Assessment
This skill is internally consistent and only needs an API key and an endpoint for the XiaoSu search service. Before installing, verify you trust the XiaoSu service (https://www.xiaosuai.com) because the provided API key will be sent to searchapi.xiaosuai.com. Do not reuse highly privileged or unrelated credentials as XIAOSU_AK. Prefer storing the key in a secure secrets manager or OpenClaw's secure env mechanism rather than plaintext shell profiles. If you need stronger assurance, review network traffic or run the script in an isolated environment to confirm it only communicates with the documented endpoint.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bcbdeg3aetvn8t92k23q7hd83e7tf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments