by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to be a straightforward wrapper around Baidu's qianfan web_search API, but exercise caution before installing: 1) Verify provenance — there is no homepage and the metadata owner/version in _meta.json doesn't match the registry metadata, which could indicate a repackaging or stale files. 2) Confirm dependencies — the script uses the Python 'requests' package but SKILL.md does not declare it; ensure your environment has requests installed. 3) Secrets handling — the reference sug...详细分析 ▾
ℹ 用途与能力
The skill's name, description, and code align with a Baidu AI web-search helper and the only required credential (BAIDU_API_KEY) is appropriate. However, metadata inconsistencies are present: the top-level registry Owner ID differs from the _meta.json ownerId, and the declared version (1.0.0) differs from _meta.json version (1.1.3). The package has no homepage or published source URL, which reduces provenance trust.
ℹ 指令范围
SKILL.md and scripts/search.py stick to the advertised scope: they construct a request to Baidu's qianfan API and print results. The reference instructions ask you to store BAIDU_API_KEY in ~/.openclaw/openclaw.json and restart OpenClaw — this is consistent with configuring an agent but does instruct writing a secret into a config file. The runtime does not read unrelated files or other env vars.
✓ 安装机制
This is an instruction-only skill with a small Python script and no install spec. No archive downloads or external installers are used, so install mechanism risk is low.
ℹ 凭证需求
Only BAIDU_API_KEY is required and is appropriate for calling Baidu's API. Minor concern: the README suggests placing the key into ~/.openclaw/openclaw.json (plaintext in a config file). The code itself reads the key from the BAIDU_API_KEY environment variable. No other credentials are requested.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide settings. It runs only when invoked by the user or agent per normal defaults.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/19
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install baidu-search-1
镜像加速npx clawhub@latest install baidu-search-1 --registry https://cn.longxiaskill.com