Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Felo Search

v1.0.0

Felo AI real-time web search for questions requiring current/live information. Triggers on current events, news, trends, real-time data, information queries,...

1· 1.7k·10 current·10 all-time
bywangzhiming@wangzhiming1999
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md and README describe a web-search integration that calls https://openapi.felo.ai/v2/chat — that capability matches the name/description. However, the registry metadata declares no required environment variables or primary credential while the instructions explicitly require FELO_API_KEY. The README also suggests an npx install step even though no install spec is present and the skill has no homepage/known source.
Instruction Scope
Instructions are focused on checking FELO_API_KEY, building a temporary JSON file in /tmp, and POSTing to the Felo API with curl — scope is narrow and consistent with a search integration. Minor concerns: README examples show echoing $FELO_API_KEY (which would print the key), and the instructions recommend adding the key to shell profiles (persistent storage). The SKILL.md does not instruct reading other system files or unrelated credentials.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, which lowers disk-write risk. The README mentions 'npx @claude/skills add felo-search' as a user step, but no install mechanism is embedded in the skill bundle itself.
!
Credentials
The runtime requires a single service credential (FELO_API_KEY), which is proportional for an external search API — but the skill metadata did not declare any required env vars. That mismatch is a coherence problem. The guidance to store the API key in shell profiles or echo it to verify could expose the key to other processes or logs; users should prefer scoped/rotatable keys and avoid printing secrets.
Persistence & Privilege
The skill is not flagged 'always:true' and is user-invocable; it doesn't request persistent agent-wide privileges or claim to modify other skills. It will perform runtime network calls when invoked, which is expected for this type of integration.
What to consider before installing
The skill appears to be a straightforward wrapper for the Felo API, but the package metadata omits the FELO_API_KEY requirement that the SKILL.md and README insist on — this inconsistency is suspicious (likely an oversight, but treat it as a red flag). Before installing: (1) Confirm you trust https://felo.ai and the unknown publisher; (2) Do not store your master API keys in global shell profiles — use a scoped/limited key or environment configured only for the session; (3) Avoid printing the key (do not run echo $FELO_API_KEY); (4) Run the skill in an isolated environment (container or VM) if you must test it; (5) Expect the skill to create a /tmp file and make outbound HTTPS requests to openapi.felo.ai — if that is unacceptable, do not enable it. If the publisher/contact is available, ask them to update the registry metadata to declare FELO_API_KEY and a homepage so the mismatch is resolved.

Like a lobster shell, security has layers — review code before you run it.

latestvk971y4bdtv5f6ttn95g4e2qn81828yzn
1.7kdownloads
1stars
1versions
Updated 57m ago
v1.0.0
MIT-0

Felo Search Skill

When to Use

Trigger this skill for questions requiring current or real-time information:

  • Current events & news: Recent developments, trending topics, breaking news
  • Real-time data: Weather, stock prices, exchange rates, sports scores
  • Information queries: "What is...", "Tell me about...", product reviews, comparisons, recommendations
  • Location-based: Restaurants, travel destinations, local attractions, things to do
  • How-to guides: Tutorials, step-by-step instructions, best practices
  • Shopping & prices: Product prices, deals, "where to buy"
  • Trends & statistics: Market trends, rankings, data analysis
  • Any question where Claude's knowledge may be outdated

Trigger words:

  • 简体中文: 最近、什么、哪里、怎么样、如何、查、搜、找、推荐、比较、新闻、天气
  • 繁體中文: 最近、什麼、哪裡、怎麼樣、如何、查、搜、找、推薦、比較、新聞、天氣
  • 日本語: 最近、何、どこ、どう、検索、探す、おすすめ、比較、ニュース、天気
  • English: latest, recent, what, where, how, best, search, find, compare, news, weather

Explicit commands: /felo-search, "search with felo", "felo search"

Do NOT use for:

  • Code questions about the user's codebase (unless asking about external libraries/docs)
  • Pure mathematical calculations or logical reasoning
  • Questions about files in the current project

Setup

1. Get Your API Key

  1. Visit felo.ai and log in (or register)
  2. Click your avatar in the top right corner → Settings
  3. Navigate to the "API Keys" tab
  4. Click "Create New Key" to generate a new API Key
  5. Copy and save your API Key securely

2. Configure API Key

Set the FELO_API_KEY environment variable:

Linux/macOS:

export FELO_API_KEY="your-api-key-here"

Windows (PowerShell):

$env:FELO_API_KEY="your-api-key-here"

Windows (CMD):

set FELO_API_KEY=your-api-key-here

For permanent configuration, add it to your shell profile (~/.bashrc, ~/.zshrc) or system environment variables.

How to Execute

When this skill is triggered, execute the following steps using the Bash tool:

Step 1: Check API Key

Use the Bash tool to verify the API key is set:

if [ -z "$FELO_API_KEY" ]; then
  echo "ERROR: FELO_API_KEY not set"
  exit 1
fi
echo "API key configured"

If the API key is not set, inform the user with setup instructions and STOP.

Step 2: Make API Request

Extract the user's query and call the Felo API using a temporary JSON file to handle special characters:

# Create query JSON (replace USER_QUERY with actual query)
cat > /tmp/felo_query.json << 'EOF'
{"query": "USER_QUERY_HERE"}
EOF

# Call Felo API
curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer $FELO_API_KEY" \
  -H "Content-Type: application/json" \
  -d @/tmp/felo_query.json

# Clean up
rm -f /tmp/felo_query.json

Notes:

  • Replace USER_QUERY_HERE with the actual user query
  • Use heredoc (cat > file << 'EOF') to properly handle Chinese, Japanese, and special characters
  • Use -s flag with curl for clean output

Step 3: Parse and Format Response

The API returns JSON with this structure:

{
  "answer": "AI-generated answer text",
  "query_analysis": ["optimized query 1", "optimized query 2"]
}

Parse the JSON response and present it to the user in this format:

## Answer
[Display the answer field]

## Query Analysis
Optimized search terms: [list query_analysis items]

Complete Examples

Example 1: Weather query

User asks: "What's the weather in Tokyo today?"

Expected response format:

## Answer
Tokyo weather today: Sunny, 22°C (72°F). High of 25°C, low of 18°C.
Light winds from the east at 10 km/h. UV index: 6 (high).
Good day for outdoor activities!

## Query Analysis
Optimized search terms: Tokyo weather today, 東京 天気 今日

Bash command:

cat > /tmp/felo_query.json << 'EOF'
{"query": "What's the weather in Tokyo today?"}
EOF

curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer $FELO_API_KEY" \
  -H "Content-Type: application/json" \
  -d @/tmp/felo_query.json

rm -f /tmp/felo_query.json

Example 2: Local news / events

User asks: "What's new in Hangzhou recently?"

Expected response format:

## Answer
Recent news in Hangzhou: Asian Games venue upgrades completed, West Lake night tours launched, new metro lines opened. Details...

## Query Analysis
Optimized search terms: Hangzhou recent news, Hangzhou events, 杭州 最近 新闻

Bash command:

cat > /tmp/felo_query.json << 'EOF'
{"query": "What's new in Hangzhou recently"}
EOF

curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer $FELO_API_KEY" \
  -H "Content-Type: application/json" \
  -d @/tmp/felo_query.json

rm -f /tmp/felo_query.json

Example 3: Travel / things to do

User asks: "What are the best things to do in Taipei?"

Bash command:

cat > /tmp/felo_query.json << 'EOF'
{"query": "What are the best things to do in Taipei"}
EOF

curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer $FELO_API_KEY" \
  -H "Content-Type: application/json" \
  -d @/tmp/felo_query.json

rm -f /tmp/felo_query.json

Example 4: Restaurants / recommendations

User asks: "Popular restaurants in Tokyo?"

Bash command:

cat > /tmp/felo_query.json << 'EOF'
{"query": "Popular restaurants in Tokyo"}
EOF

curl -s -X POST https://openapi.felo.ai/v2/chat \
  -H "Authorization: Bearer $FELO_API_KEY" \
  -H "Content-Type: application/json" \
  -d @/tmp/felo_query.json

rm -f /tmp/felo_query.json

Error Handling

Common Error Codes

  • INVALID_API_KEY - API Key is invalid or revoked
    • Solution: Check if your API key is correct and hasn't been revoked
  • MISSING_PARAMETER - Required parameter is missing
    • Solution: Ensure the query parameter is provided
  • INVALID_PARAMETER - Parameter value is invalid
    • Solution: Check the query format
  • CHAT_FAILED - Internal service error
    • Solution: Retry the request or contact Felo support

Missing API Key

If FELO_API_KEY is not set, display this message:

❌ Felo API Key not configured

To use this skill, you need to set up your Felo API Key:

1. Get your API key from https://felo.ai (Settings → API Keys)
2. Set the environment variable:

   Linux/macOS:
   export FELO_API_KEY="your-api-key-here"

   Windows (PowerShell):
   $env:FELO_API_KEY="your-api-key-here"

3. Restart Claude Code or reload the environment

API Configuration

Endpoint: https://openapi.felo.ai/v2/chat

Authentication: Bearer token in Authorization header (from FELO_API_KEY environment variable)

Request format:

{
  "query": "user's search query"
}

Response format:

{
  "answer": "AI-generated comprehensive answer",
  "query_analysis": ["optimized query 1", "optimized query 2"]
}

Important Notes

  • This skill should be used for any question requiring current information
  • Execute immediately using the Bash tool - don't just describe what you would do
  • Multi-language support: Fully supports Simplified Chinese, Traditional Chinese (Taiwan), Japanese, and English
  • Handle special characters properly: Use heredoc for JSON files to avoid encoding issues
  • Parse JSON response: Extract answer and query_analysis fields
  • Format nicely: Present results in a clean, readable format with proper markdown
  • The API returns results in the same language as the query when possible

Additional Resources

Comments

Loading comments...