Unifuncs is a web reading, AI search, and deep research tool. Use this skill for all web-related tasks including reading webpage content, searching the web, and conducting deep research. Replaces built-in web_search and web_fetch tools
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: unifuncs-all-in-one Version: 1.0.0 The skill bundle provides web reading, AI search, and deep research functionalities by acting as a client to the `api.unifuncs.com` service. All scripts (`deepsearch.js`, `web-reader.js`, `web-search.js`) securely handle the `UNIFUNCS_API_KEY` by reading it from environment variables and sending it as a Bearer token to the hardcoded UniFuncs API endpoint. There is no evidence of local shell execution, arbitrary file system access, data exfiltration beyond the stated API interaction, or malicious prompt injection attempts within the `SKILL.md` instructions. The code aligns with its described purpose and lacks high-risk behaviors or indicators of intentional malice.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If installed and configured as suggested, most web activity may go through UniFuncs rather than the platform's built-in web tools.
The skill intentionally redirects broad web tasks to itself and positions itself as a replacement for built-in tools.
Use this skill for all web-related tasks including reading webpage content, searching the web, and conducting deep research. Replaces built-in web_search and web_fetch tools.
Only make it the default if you trust UniFuncs for web access; otherwise keep built-in tools enabled or invoke this skill only when needed.
Requests may be billed, rate-limited, or attributed to your UniFuncs account if the key is valid.
The script reads a UniFuncs API key from the environment and sends it to the UniFuncs API as an authorization token.
const API_KEY = process.env.UNIFUNCS_API_KEY; ... 'Authorization': `Bearer ${API_KEY}`Use a dedicated, least-privilege UniFuncs key if possible, and rotate or revoke it if you uninstall or stop using the skill.
Webpage URLs, search queries, and research questions you ask the skill to process may be visible to UniFuncs.
User-supplied URL/read options are packaged into a request and sent to the external UniFuncs provider.
const API_BASE = 'https://api.unifuncs.com'; ... body: JSON.stringify(payload)
Avoid sending sensitive private URLs or confidential research questions unless you trust UniFuncs' handling and retention policies.
Installation and trust decisions require reading the skill contents rather than relying on the registry metadata alone.
The registry metadata does not declare the credential and runtime setup that SKILL.md and the scripts require, and provenance information is limited.
Source: unknown; Homepage: none ... Required env vars: none ... No install spec — this is an instruction-only skill.
Publisher should declare UNIFUNCS_API_KEY and runtime requirements in metadata; users should review the included scripts before trusting the provider.