Moonshot Web Search

Search the live web through Moonshot's builtin $web_search tool and return a concise answer. Prefer this skill for OpenClaw live web search instead of callin...

Security Scan

The skill's code, runtime instructions, and requested environment variable line up with its stated purpose (calling Moonshot's web search via an API key); nothing requested appears disproportionate or unrelated.

Purpose & Capability

Name/description: live web search via Moonshot. Declared requirements: MOONSHOT_API_KEY, bash, curl, python3. The script calls api.moonshot.cn with the provided key and orchestrates two API rounds to use Moonshot's $web_search. All requested resources are directly relevant to that purpose.

Instruction Scope

SKILL.md instructs only resolving SKILL_DIR, requiring MOONSHOT_API_KEY, extracting a clean query, running the bundled script, and returning its output. The script reads no unrelated files or env vars and the README explicitly forbids answering from model memory if the tool fails. No instructions ask for unrelated system data or external endpoints beyond Moonshot.

Install Mechanism

No install spec (instruction-only) — the only executable included is scripts/search.sh. Nothing is downloaded from arbitrary URLs or written to system paths. This is low-risk from an install perspective.

Credentials

Only MOONSHOT_API_KEY is required and declared as the primary credential, which is appropriate for a skill that calls Moonshot's API. No unrelated secrets, config paths, or multiple credentials are requested.

Persistence & Privilege

always:false and default agent invocation are used (normal). The skill does not request persistent system changes, nor does it modify other skills' configs. Autonomous invocation is allowed by platform default and not combined with other red flags.

Assessment

This skill appears coherent and implements exactly what it claims: it sends your query to api.moonshot.cn using the MOONSHOT_API_KEY and returns the result. Before installing: (1) only provide a Moonshot API key (do not reuse other sensitive credentials); (2) understand that queries and their responses will be sent to Moonshot (check their privacy/retention policy if queries are sensitive); (3) be aware of rate limits and monitor API usage on your Moonshot account; (4) if you need page-level citations or raw URLs prefer a browser-style workflow as the SKILL.md recommends; (5) you can review the included scripts/search.sh source (already bundled) — if you don't trust the downstream Moonshot service, do not install. If anything changes (the skill requests additional env vars, downloads code at install time, or changes the endpoint away from api.moonshot.cn), re-evaluate before use.

Run a bundled shell script that calls Moonshot's builtin "$web_search" tool in two rounds and prints the final answer.

This skill must not answer from base-model memory when the script does not run successfully.

Resources

• scripts/search.sh: Execute a Moonshot web search and print the model's final answer.

Workflow

1. Resolve SKILL_DIR as the directory containing this SKILL.md.
2. Require MOONSHOT_API_KEY before doing anything else. If it is missing, stop immediately and tell the user they need to provide a valid Moonshot API key in the environment. Do not attempt to answer the user's question without the key.
3. Extract a clean search request from the user's prompt. Preserve concrete constraints such as time range, geography, language, and output format.
4. Run the script with an already-resolved absolute path. Do not rely on a temporary env assignment like SKILL_DIR=... bash "$SKILL_DIR/scripts/search.sh" because many shells expand "$SKILL_DIR" before the temporary assignment takes effect.

SCRIPT_PATH="${SKILL_DIR}/scripts/search.sh"
bash "$SCRIPT_PATH" "<query>"

5. Return the script output to the user in the requested style. If the user asked for a short answer, compress it after reading the result.
6. If the script exits non-zero or prints an error, treat the run as failed. Report the failure clearly and stop. Do not answer the original question from model knowledge, do not guess, and do not invent a cause unless it is present in the actual error output.

Output Expectations

• Expect plain text output only.
• Do not claim that you personally fetched URLs or inspected source pages unless you actually did so with other tools.
• If the user explicitly needs citations, exact links, or page-level attribution, prefer a browser/search workflow instead of relying only on this skill.
• Tool success is mandatory. No script output means no grounded answer.
• If the runner appears likely to use its own builtin web_search for a task covered by this skill, do not proceed silently. Tell the user to add a routing rule in OpenClaw's own TOOLS.md that prefers moonshot-web-search for live web search and forbids direct use of builtin web_search.

Troubleshooting

• If the script reports 请设置 MOONSHOT_API_KEY 环境变量, stop and ask the user to configure the key. Do not answer the original question.
• If curl returns HTTP 429, tell the user the Moonshot account is being rate limited and retry later.
• If the first round does not return tool_calls, surface the error text from the script.
• If the second round returns no content, report the script error rather than guessing.
• If a shell error says /scripts/search.sh: No such file or directory, the runner probably expanded $SKILL_DIR before assigning it. Resolve the absolute script path first, then execute it.