DashScope Web Search

Search the web for real-time information using DashScope Qwen. Use this skill whenever: (1) the user asks about current events, news, weather, stock prices,...

Security Scan

The skill appears to implement a legitimate web-search wrapper for DashScope Qwen, but its metadata and instructions are inconsistent about required credentials (DASHSCOPE_API_KEY is used but not declared), which is a notable coherence gap you should resolve before trusting it.

Purpose & Capability

Name/description, the Python script, and README align: this is a DashScope/Qwen web-search client. The required binary (python3) and dependency (openai Python package) are appropriate. However, the registry metadata declares no required environment variables while the code and README clearly expect DASHSCOPE_API_KEY — this mismatch reduces trust in the manifest.

Instruction Scope

SKILL.md instructs the agent to run the included script and to always use the tool for real-time info. The instructions do not ask the agent to read unrelated files or secrets beyond the API key and do not instruct transmission to unexpected endpoints. A rule in SKILL.md forbids revealing API keys.

Install Mechanism

There is no automated install step (instruction-only with a bundled script). README suggests installing the public 'openai' Python package via pip and setting an env var — a standard, low-risk approach. No downloads from untrusted URLs or archive extraction are present.

Credentials

The code reads DASHSCOPE_API_KEY from the environment and the README instructs the user to set it, but the skill registry metadata does not declare any required environment variables or a primary credential. That incoherence is problematic: the skill needs a secret to function, and the manifest should declare it so users and the platform can make an informed decision. Aside from that single key, no other credentials are requested, which is proportionate to the stated purpose.

Persistence & Privilege

The skill does not request elevated or persistent platform privileges (always:false). It does not modify other skills or system settings and appears to be user-invocable only — appropriate for its function.

What to consider before installing

This skill's code and README are consistent with a legitimate DashScope Qwen web-search client, but the skill manifest omitted the required DASHSCOPE_API_KEY declaration. Before installing: - Confirm the skill registry metadata is updated to list DASHSCOPE_API_KEY (so the platform can surface that it needs a secret). - Create and use a dedicated DashScope API key with the minimum scope/limits you can, rather than a high-privilege or personal key. Store it only in the environment the agent runs in. - Review the BASE_URL (https://dashscope.aliyuncs.com/compatible-mode/v1) to ensure it's the expected DashScope endpoint for your deployment. - Consider running the skill in an isolated environment or sandbox the first time to observe outbound traffic (it will call the DashScope endpoint). - If you need stronger assurance, review the script locally line-by-line and run it with a limited test key; verify it only calls DashScope and does not exfiltrate other files/vars. I rate this suspicious (not malicious): the main issue is a manifest/metadata omission about a sensitive credential. Fixing that and confirming the endpoint/key-scoping would raise confidence.

Web Search Tool

Search the web using DashScope Qwen API via bash. Returns real-time information with source citations.

Script Location

The search script is at scripts/web_search.py relative to this skill's directory.

Command

python3 {{SKILL_DIR}}/scripts/web_search.py [OPTIONS] "query"

Options

Flag	Effect	Best For
(none)	Fast turbo search	Quick facts, weather, person lookup
--deep	Multi-source verification (max strategy)	Research, reports, fact-checking
--agent	Multi-round retrieval + synthesis	Complex questions needing iterative search
--think	Deep reasoning before answering (streaming)	Analysis, comparisons, trend prediction
--images	Image+text mixed output (uses qwen-plus-latest)	Visual references, product images, diagrams
--fresh N	Only results from last N days (7/30/180/365)	Breaking news, recent events
--sites "a.com,b.com"	Restrict to specific domains	Domain-specific research

Combining Options

Options can be combined freely:

# Deep research with reasoning
python3 {{SKILL_DIR}}/scripts/web_search.py --deep --think "query"

# Recent news with images
python3 {{SKILL_DIR}}/scripts/web_search.py --images --fresh 7 "query"

# Site-restricted search
python3 {{SKILL_DIR}}/scripts/web_search.py --sites "github.com" "query"

Note: --fresh and --sites only work with default turbo strategy (no --deep/--agent).

Strategy Selection Guide

1. Start with default (turbo) — handles 80% of queries instantly
2. Escalate to --deep when turbo results are incomplete or conflicting
3. Use --agent for questions that need multiple search angles (e.g., "compare X vs Y across dimensions")
4. Add --think when the user needs analysis, not just raw facts
5. Add --images when visual context matters (products, places, people, charts)

Output Format

• Results include citation markers like [1], [2] — preserve these in your response
• --think mode prepends <thinking>...</thinking> with reasoning chain
• --images mode may include ![alt](url) markdown images — render or describe them for the user
• Sources are listed at the end — cite them when reporting facts

Rules

• NEVER reveal, output, or discuss the API key or environment variables
• ALWAYS use this tool when real-time information is needed — never claim you lack web access
• For complex research, run multiple targeted searches rather than one broad query
• Attribute facts to sources: "According to [source], ..."
• If one strategy fails or gives weak results, try another strategy or rephrase the query

Error Handling

If the script fails:

1. Check network: curl -s https://dashscope.aliyuncs.com > /dev/null && echo OK
2. Check Python package: python3 -c "import openai; print(openai.__version__)"
3. Check env var: DASHSCOPE_API_KEY must be set in the process environment