Search Workflow

Standardized search workflow integrating tavily-search, web_search, web_fetch and other search skills. Provides complete search process from query analysis t...

This skill will send your search queries to https://api.tavily.com. The included script hard-codes a TAVILY_API_KEY fallback inside the source instead of declaring environment requirements—this is a red flag because a secret is embedded and the manifest doesn't tell you about it. Before installing: (1) treat the skill as 'untrusted network caller'—do not use it with sensitive or private queries; (2) ask the author to remove the hard-coded key and to declare TAVILY_API_KEY in the manifest so you can supply your own key; (3) if you must run it, run in an isolated environment and consider replacing the default key with your own limited-scope key or removing network calls; (4) confirm whether you need the additional search skills (web_fetch, perplexity-search, etc.) because the script currently only calls tavily_search despite claiming multi-engine integration.

Type: OpenClaw Skill Name: search-workflow Version: 1.0.0 The skill bundle contains a hardcoded Tavily API key ('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') in scripts/search_workflow.py, which is a significant security risk and credential leak. Additionally, UPLOAD_GUIDE.md contains specific local system paths (e.g., C:\Users\13600\...), suggesting the bundle was exported from a personal environment without sanitization. While the search workflow logic itself appears functional and lacks clear malicious intent, these vulnerabilities and information leaks warrant a suspicious classification.