Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Baidu Web Search
v2.1.2Perform web searches using Baidu API with a focus on Chinese content, customizable result counts, and easy OpenClaw integration.
⭐ 0· 111·0 current·0 all-time
byClawMem.com@leohuang8688
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the code: the Python client calls a Baidu Search API and returns results. However, the registry metadata declares no required environment variables or primary credential while SKILL.md and the code both require BAIDU_API_KEY. That mismatch is incoherent: a search skill should declare the API key as a required credential in the metadata.
Instruction Scope
Runtime instructions and code are narrowly scoped to making HTTP requests to a Baidu API and formatting results. The code loads an .env file from the repository/workspace root (Path(__file__).parent.parent / '.env'), which means it can pick up any other secrets stored in that workspace .env unexpectedly. The HTTP outbound traffic appears only to the Baidu API host in the code (no other hidden endpoints).
Install Mechanism
No automated install script is present (instruction-only install). A requirements.txt lists only requests and python-dotenv — standard and proportionate. There are no downloads from arbitrary URLs or extract steps.
Credentials
Functionally the skill only needs a single API key (BAIDU_API_KEY), which is proportionate. But the registry metadata incorrectly lists no required env vars/primary credential, while SKILL.md and code require BAIDU_API_KEY. Additionally, auto-loading a workspace .env risks picking up unrelated secrets present in the environment, which increases the blast radius.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or global agent settings. It runs on demand and has no elevated persistence privileges.
What to consider before installing
This skill appears to be a straightforward Baidu search client, but there are two issues you should address before installing: (1) the registry metadata incorrectly omits the required BAIDU_API_KEY — ask the author to declare this credential in the metadata so you know what will be requested; (2) the code auto-loads a .env file from the workspace root, which could cause the skill to read other secrets if a .env exists there. If you proceed, run it in an isolated environment, ensure your workspace .env contains only the Baidu API key (or avoid a shared .env entirely by exporting BAIDU_API_KEY explicitly), and review the code yourself. If you cannot verify the author or update the metadata, treat the package as untrusted and test in a sandboxed container. If you want higher assurance, request the author to remove workspace-wide dotenv loading or to explicitly document and minimize what the .env must contain.Like a lobster shell, security has layers — review code before you run it.
latestvk978j2p2903crb41ywnz273a6h834mz6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.