iFlytek Web Search

Search the web using iFlytek ONE SEARCH API (万搜/聚合搜索). Returns titles, summaries, URLs, and full text from web pages. Good for Chinese-language web search.

Security Scan

The skill appears to implement the advertised iFlytek web search behavior, but registry metadata omits the required XFYUN_API_PASSWORD and the package has no provenance (no homepage/source), so verify credentials and origin before installing.

Purpose & Capability

Name, description, SKILL.md, and the included script all consistently implement an iFlytek (Xfyun) ONE SEARCH client that posts queries to the documented API endpoint and returns titles/summaries/full text. The requested functionality matches the stated purpose (Chinese web search).

Instruction Scope

Runtime instructions and the provided script stay within the expected scope: they only read one environment variable (XFYUN_API_PASSWORD), construct a JSON payload, POST to the documented Xfyun endpoint, and print results. The script does not access other files, system state, or external endpoints beyond the API URL. However, the SKILL.md requires an environment variable that the registry metadata did not declare (see environment_proportionality).

Install Mechanism

No install spec is provided (instruction-only with an included Python script). Nothing is downloaded or written to disk by an installer. This is low-risk from an install-mechanism perspective.

Credentials

The SKILL.md and script require the secret environment variable XFYUN_API_PASSWORD to authenticate to the Xfyun API. However, the registry metadata lists 'Required env vars: none' and 'Primary credential: none', an inconsistency that could mislead users. Requesting a single API password for the stated API is proportionate, but the metadata omission and lack of a declared primary credential reduce transparency and are a concern.

Persistence & Privilege

The skill is not always-enabled and does not request persistent system-level privileges or modify other skills/config. Autonomous invocation is allowed (the platform default) but not combined with other high-risk behaviors.

What to consider before installing

This skill appears to be a straightforward client for iFlytek ONE SEARCH and only needs one secret: XFYUN_API_PASSWORD. Before installing: (1) Verify the skill's provenance — there is no homepage or publisher information in the registry entry; prefer skills from known publishers. (2) Confirm the registry metadata is updated to declare XFYUN_API_PASSWORD as a required credential (and a primary credential) so you know what you'll be exposing. (3) Provide an API password scoped for search usage (least privilege) and monitor its usage/quota. (4) Be aware that using --raw returns full page text (which may contain PII or sensitive data) — avoid sending sensitive queries. (5) If you are concerned about network calls or secrets, run the script in an isolated environment or review network logs to ensure it's calling only the documented Xfyun endpoint.

xfyun-search

Search the web using iFlytek ONE SEARCH API (万搜/聚合搜索). Returns titles, summaries, URLs, and full text content from web pages.

When to Use

• User asks to search the Chinese web or needs Chinese-language search results
• Need an alternative to Brave Search (especially for Chinese content)
• User explicitly requests iFlytek / 讯飞 / 万搜 search

Prerequisites

• Python 3 (standard library only, no pip install needed)
• Environment variable: XFYUN_API_PASSWORD — API password from 讯飞控制台

Usage

The script is at scripts/search.py relative to this skill directory.

Basic Search

python3 scripts/search.py "搜索关键词"

Options

Flag	Description
--limit N	Max results, 1–20 (default 10)
--no-rerank	Disable result reranking
--no-fulltext	Disable full text retrieval
--raw	Output raw JSON instead of formatted text

Examples

# Simple search
python3 scripts/search.py "美国现任总统是谁"

# Limit to 5 results
python3 scripts/search.py "Python asyncio 教程" --limit 5

# Raw JSON output for programmatic use
python3 scripts/search.py "量子计算最新进展" --raw

# Minimal mode — no rerank, no full text
python3 scripts/search.py "天气预报" --no-rerank --no-fulltext

Output Format (default)

Query: 美国现任总统是谁

## 1. Page Title
URL: https://example.com/page
Summary: Brief description of the page content

## 2. Another Result
URL: https://example.com/other
Summary: Another brief description

Output Format (--raw)

Returns the full API JSON response including data.search_results.documents[].content (full page text).

API Details

• Endpoint: POST https://search-api-open.cn-huabei-1.xf-yun.com/v2/search
• Auth: Authorization: Bearer <XFYUN_API_PASSWORD>
• Rate limits: Per-app daily and per-second limits apply (see error codes below)

Error Codes

Code	Meaning
0	Success
11200	Authorization error or quota exceeded
11201	Daily rate limit exceeded
11202	Per-second rate limit exceeded
11203	Concurrent connection limit exceeded
21001	Missing parameters
21009	Unauthorized appId

Tips

• Use complete questions (e.g. "美国现任总统是谁？") rather than keywords for better time-sensitive results
• Query length should be ≤512 characters