bocha-skill

This skill appears to be a straightforward Bocha API search wrapper, but take these precautions before installing or running any included scripts: - Do not assume the API key shown in PUBLISH.md is safe to use; treat it as a leaked/example key. Replace it with your own key and verify the example key is invalid before trusting the repository. - Inspect publish.sh before running it: it will install a global npm package (clawdhub) and run clawdhub publish which performs network operations and may require you to supply a publish token. Only run it if you intend to publish and you trust the destination. - Verify the API endpoint you want to use. The code calls https://api.bocha.cn/v1/web-search while some docs reference other domains (api.bocha-ai.com, open.bocha.cn). Confirm with Bocha's official docs which endpoint is correct to avoid misrouting credentials. - Because the skill reads only BOCHA_API_KEY, avoid providing other credentials. Store the key in your environment or OpenClaw config and do not hardcode it into files that may be published. - If you plan to publish this skill publicly, remove/redact any example keys from documentation and rotate any real keys that may have been accidentally committed. If the repository owner can confirm the example key in PUBLISH.md is not valid and fix the inconsistent endpoint references, my confidence would rise and the skill would look benign.