Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

smart-research

v1.0.0

多引擎搜索 + 多级降级抓取 + 结构化研究结果。零API Key,一键完成搜索+抓取+融合。

0· 73·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xx235300/smart-research.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "smart-research" (xx235300/smart-research) from ClawHub.
Skill page: https://clawhub.ai/xx235300/smart-research
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3, uv
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install smart-research

ClawHub CLI

Package manager switcher

npx clawhub@latest install smart-research
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the code: the package implements multi-engine search and a multi-stage fetch fallback chain. However there are oddities: the SKILL.md Execution block references script_path: scripts/smart_research.py but the manifest contains smart_research.py at the repository root (path mismatch). The metadata requires a binary named 'uv' (and SKILL.md uses 'uv pip install'), which is a nonstandard wrapper and may not be present on user systems — this is unusual but plausibly needed by the author's environment. Dependency/version lists differ between SKILL.md and requirements.txt (e.g. baidusearch and crawl4ai versions), which is inconsistent and may break installs.
!
Instruction Scope
The runtime instructions and code use multiple external fetch services (crawl4ai, r.jina.ai/Jina Reader, markdown.new, defuddle, Playwright). That implies the skill will send target URLs (and potentially page content) to third-party services during fetching. This contradicts repeated "privacy-first / no data collection / local execution" claims in the README/SKILL.md. Fetching arbitrary URLs is expected for this tool, but the use of external remote extractors means user content or target URLs can be transmitted off-device — the SKILL.md does not clearly state this data flow.
!
Install Mechanism
No formal install spec is present in the registry entry despite code files and an Execution YAML in SKILL.md listing dependencies. The SKILL.md expects use of a nonstandard 'uv' command to install packages (e.g. 'uv pip install --system -r requirements.txt'); requiring the 'uv' binary and its usage is unusual and may hide platform-specific behavior. There is no download-from-URL or archive-extract risk in the manifest, but the mismatch between declared dependencies in SKILL.md and requirements.txt (different package names/versions) is a practical installation risk.
Credentials
The skill does not request credentials and declares no required env vars (primaryEnv none). SKILL.md documents optional environment variables (HTTP_PROXY, HTTPS_PROXY, TIMEOUT, PLAYWRIGHT_HEADLESS), which are reasonable for a networked fetcher. No secret-exfiltration patterns were declared, but the skill will perform network requests to third-party services — users should treat that as potential data exposure.
Persistence & Privilege
always is false and the skill does not request elevated or persistent platform privileges. It does not modify other skills' configs per the provided files. Autonomous invocation is allowed (default) which is normal and not flagged on its own.
What to consider before installing
This skill implements the advertised search+fetch features, but several red flags merit caution: (1) SKILL.md claims "local execution / no data collection" while the fetch fallback uses external services (r.jina.ai, crawl4ai, markdown.new, defuddle) — those requests will expose target URLs and possibly page contents to those services; verify you are comfortable with that data flow before using it on private/internal URLs. (2) The Execution block references scripts/smart_research.py but the repository manifest shows smart_research.py at the root — fix the script_path or adjust how you invoke it. (3) The skill expects a nonstandard binary 'uv' and uses 'uv pip' in docs; ensure you understand what 'uv' is and trust it before running install commands. (4) Dependency/version inconsistencies between SKILL.md and requirements.txt may cause installation/runtime errors. Recommended steps: review the fetcher implementations (how/when they call external endpoints), run the code in a sandboxed environment or behind a proxy, validate and pin the dependencies you will install, and avoid feeding private/internal URLs to this skill unless you have explicitly audited the remote services it uses.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🔍 Clawdis
Binspython3, uv
latestvk978jghy6gy33f9p575fdsece584ja92
73downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

smart-research

Universal research skill — multi-engine search + multi-layer fallback fetching + structured results.

Features

  • 🔍 Multi-Engine Search: Baidu, DuckDuckGo, Bing with automatic fallback
  • 🔄 Multi-Layer Fallback Fetching: crawl4ai → Jina → markdown.new → defuddle → Playwright
  • 📊 Structured Output: title / body / href / source_type / fetch_method / fetched_at
  • 🚀 Zero API Key: All services are free
  • 📦 One-Click Research: Single research() action for search + fetch + fusion

Architecture

┌─────────────────────────────────────────────┐
│           smart-research 统一入口            │
└─────────────────────────────────────────────┘
                     │
   ┌─────────────────┼─────────────────┐
   ▼                 ▼                 ▼
┌────────┐      ┌────────┐       ┌────────┐
│ Search │      │ Fetch  │       │ Fusion │
│ Layer  │      │ Layer  │       │ Layer  │
└────────┘      └────────┘       └────────┘

Usage

Python API

result = main({
    "action": "research",
    "query": "Python tutorial",
    "num_results": 5,
    "crawl_depth": 3
})

Search Only

result = main({
    "action": "search",
    "query": "machine learning latest research",
    "num_results": 5
})

Fetch Only

result = main({
    "action": "fetch",
    "url": "https://example.com/article"
})

Deep Search

result = main({
    "action": "deep_search",
    "query": "AI agent trends 2024",
    "num_results": 5
})

Input Parameters

ParameterTypeRequiredDefaultDescription
actionstringYes-Operation type: research, search, fetch, deep_search
querystringConditional-Search query (required for research/search/deep_search)
urlstringConditional-Target URL (required for fetch)
num_resultsintNo5Number of search results (1-20)
crawl_depthintNo3Number of top results to fetch details (1-10)

Output Format

Research Result

{
  "success": true,
  "query": "Python tutorial",
  "search_results": [
    {
      "title": "Result title",
      "href": "https://example.com",
      "body": "Snippet content",
      "score": 85.5,
      "source_type": "baidu",
      "fetch_method": "crawl4ai",
      "fetched_at": "2024-01-01T12:00:00Z"
    }
  ],
  "message": "Research completed"
}

Fetch Result

{
  "success": true,
  "url": "https://example.com",
  "content": "# Article Title\n\nClean markdown content...",
  "source": "jina",
  "fetched_at": "2024-01-01T12:00:00Z"
}

Execution

type: script
script_path: scripts/smart_research.py
entry_point: main
dependencies:
  - uv>=0.1.0
  - requests>=2.28.0
  - baidusearch>=1.0.3
  - crawl4ai>=0.8.0
  - playwright>=1.40.0

Fetch Fallback Chain

Each URL automatically tries:

PriorityServiceTimeoutDescription
1crawl4ai15sAI-powered, local
2Jina Reader10sFree, no key needed
3markdown.new8sSimple pages
4defuddle8sBetter noise reduction
5Playwright30sDynamic rendering

Privacy Notice

  • Public web pages: Fully supported
  • Private/internal URLs: Not supported by default
  • Sensitive content: Requires user consent

Error Handling

  • Returns {"success": false, "message": "..."} on errors
  • Automatically falls back to next service
  • Partial results returned if some fetches fail

Comments

Loading comments...