OpenClaw China Search Tips
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill mostly matches its stated purpose (aggregating Chinese-friendly search APIs) but contains several incoherences and one potentially suspicious third‑party endpoint that deserve clarification before use.
This skill appears to do what it says (try multiple search APIs and fallback), but there are red flags you should address before installing: 1) The registry metadata does not declare the API key environment variables the code actually uses — ask the author to list required env vars so you can consent. 2) The code calls an unexpected domain for the 'volcengine' channel (open.feedcoopapi.com) rather than a clearly official Volcengine endpoint — verify the domain's provenance and that you are comfortable sending API keys and queries to it. 3) SKILL.md suggests using a third‑party GitHub front-end (githubs.cn) to obtain login state; using such sites can expose credentials — prefer official login flows. 4) The skill imports a separate 'multi_search_engine' module for a fallback; confirm you control or trust that dependency before using. Recommended steps: inspect or run the python file in a sandboxed environment, verify and/or replace endpoints with official API URLs, require the author to update metadata to list required env vars, and avoid providing high-value credentials until you confirm endpoints and provenance. If you cannot verify the open.feedcoopapi.com endpoint and the suggested GitHub workaround, treat this as untrusted and do not provide real credentials.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.