API Hunter

Automatically searches and compiles reports of free APIs based on specific functional requirements.

Security Scan

The skill mostly does what it says (search and report free APIs) but contains unexplained choices — most notably it queries a localhost search endpoint and suggests an unused dependency — that could be abused or indicate sloppy/misleading packaging.

Purpose & Capability

The code and SKILL.md generally align with the stated purpose (search for free APIs and build a report). However, the skill hard-codes SEARCH_URL = "http://localhost:8888/search" (a local search service) while SKILL.md and metadata do not mention any requirement for a local search proxy or how to provision it. The package.json (Node metadata) and the SKILL.md suggestion to install beautifulsoup4 are inconsistent with the Python-only code (beautifulsoup4 is not used in the provided code). These mismatches are unexplained and disproportionate to the stated goal.

Instruction Scope

SKILL.md instructs running the Python script and installing libraries, but does not document that the skill will query a local search service or that it will perform HTTP GETs to arbitrary URLs returned by that search endpoint. Because the skill follows result URLs and performs session.get(url), a malicious or compromised search service could make the skill connect to internal or sensitive endpoints (e.g., cloud metadata or internal services). The instructions give the agent broad network access without any allowlist or warnings.

Install Mechanism

There is no install spec (instruction-only skill). SKILL.md suggests 'pip install beautifulsoup4 requests' — installing requests makes sense; beautifulsoup4 is unnecessary given the included code. No remote downloads or archive extraction are used, so install risk is low, but the unnecessary dependency is a sign of sloppy documentation.

Credentials

The skill declares no required environment variables or credentials, which is proportionate. However, its network behavior (contacting localhost:8888 and then arbitrary discovered URLs) effectively expands its runtime privileges beyond what the metadata declares; this implicit network access should be considered when deciding whether to allow the skill.

Persistence & Privilege

The skill is not always-enabled and does not request persistent privileges or modify other skills' configurations. Autonomous invocation is allowed by default (normal) and there is no evidence the skill escalates system privileges.

What to consider before installing

This skill appears to implement an API search and report generator, but it relies on an undocumented local search endpoint (http://localhost:8888/search). Before installing or running it, verify: (1) Why your environment would have a search service on localhost:8888 — if you don't have one, the skill will fail; if an attacker controls that endpoint, they can influence which URLs the skill visits. (2) The skill will make outbound HTTP GET requests to any URLs returned by that search service — consider running it in a network-restricted sandbox or adding an allowlist for safe domains. (3) The SKILL.md and package.json contain mismatches (unused beautifulsoup4, Node metadata) — treat this as sloppy packaging and prefer a well-documented alternative. If you need this skill, ask the author to (a) document the dependency on a search service or switch to a reputable search API, (b) add domain allowlisting or explicit warnings about internal endpoints, and (c) remove or justify unnecessary dependencies. If you cannot verify the local search service or cannot sandbox network access, do not install or run this skill with access to sensitive networks or cloud metadata endpoints.

API Hunter Skill

功能

全自動 API 服務商獵人 - 根據功能需求搜尋免費 API

安裝

# 依賴已安裝
pip install beautifulsoup4 requests

使用方式

方法 1: Python 程式碼

from api_hunter import hunt

# 搜尋天氣 API
report = hunt("weather")

# 搜尋 AI 圖片生成 API
report = hunt("AI image generation")

# 搜尋翻譯 API
report = hunt("translation")

方法 2: 命令列

cd ~/.openclaw/ai-operator/skills
python api_hunter/hunter.py "weather"

方法 3: 實例化

from api_hunter import APIHunter

hunter = APIHunter()

# 自訂搜尋
results = hunter.search("stock market data")
print(results)

# 獵取並生成報告
report = hunter.hunt("email verification")

輸出範例

## 🎯 weather API 獵人報告

### 搜尋結果

1. 🌤️ Free Open-Source Weather API | Open-Meteo.com
   URL: https://open-meteo.com/
   
2. Free Weather API - WeatherAPI.com
   URL: https://www.weatherapi.com/

### ✅ 無需註冊的 API

| API 名稱 | 網址 |
|----------|------|
| Open-Meteo | https://open-meteo.com/ |
| OpenWeatherMap | https://openweathermap.org/api |

已知免費 API 清單

天氣

API	URL	特色
Open-Meteo	https://open-meteo.com/	無需 API Key
OpenWeatherMap	https://openweathermap.org/api	免費 tier

資料

API	URL	特色
JSONPlaceholder	https://jsonplaceholder.typicode.com/	測試用
Public APIs	https://github.com/public-apis/public-apis	集合

AI/ML

API	URL	特色
Puter.js	https://developer.puter.com/	完全免費，無需 API Key，客戶端直接調用
HuggingFace	https://huggingface.co/inference-api	免費 tier
OpenAI	https://platform.openai.com/	免費 credit

圖片生成 (完全免費，無需 API Key)

Puter.js - 最強大的免費選擇：

<script src="https://js.puter.com/v2/"></script>
<script>
puter.ai.txt2img("A cute cat").then(img => {
    document.body.appendChild(img);
});
</script>

支持的模型：

• GPT Image (1, 1.5, 1.5-mini)
• DALL-E 2/3
• Gemini 2.5 Flash Image
• Flux.1 Schnell / Pro
• Stable Diffusion 3 / XL
• HiDream-I1
• Qwen-Image

限制

• 臨時郵件服務有時不穩定
• 部分網站需要 Cloudflare 驗證
• 建議優先使用無需註冊的 API