← Back to Skills Marketplace
593
Downloads
0
Stars
15
Active Installs
13
Versions
Install in OpenClaw
/install smart-search
Description
免费无限搜索！Exa MCP（主力·零配置）+ SearX（隐私）+ Tavily（AI 摘要），面向大众，无需 API Key。
Usage Guidance
What to check before installing/running Smart Search:
- Metadata mismatch: SKILL.md mentions SEARXNG_URL and TAVILY_API_KEY while registry metadata says no env vars; confirm whether you must set any env vars for your use-case (Tavily is optional; Exa MCP requires no key).
- Review ~/.openclaw/.env before running: search.sh 'sources' that file and, as a fallback, exports every key=value it contains. Only put the variables you intend (TAVILY_API_KEY, SEARXNG_URL) there — do not store unrelated secrets (AWS keys, SSH keys) in that .env.
- Network/privacy: the skill will send your query text to external services (https://mcp.exa.ai and optionally https://api.tavily.com). Do not use it to search sensitive personal, corporate, or secret information unless you have a trusted local SearX instance and force queries there.
- Inspect scripts yourself (search.sh, deploy-searx.sh, publish.sh). They are short and readable; if you are uncomfortable running them, run them in an isolated environment or container first.
- If you need strong privacy guarantees, deploy the provided local SearX and set SEARXNG_URL to the localhost instance before using the skill.
If you want, I can:
- Point out the exact lines in search.sh that read .env and call remote endpoints
- Summarize network calls that will occur for a given query
- Suggest a safe sequence of commands to run the skill in a sandboxed/containerized environment
Capability Analysis
Type: OpenClaw Skill
Name: smart-search
Version: 4.1.0
The 'smart-search' skill is a search aggregator that intelligently routes user queries between Exa MCP, a local SearX instance, and Tavily based on the search intent (e.g., technical, privacy-sensitive, or AI-assisted research). The core logic in `search.sh` uses standard `curl` commands to interact with official API endpoints and `python3` for JSON parsing, while `deploy-searx.sh` provides a legitimate utility for local Docker-based deployment of SearX. No evidence of data exfiltration, unauthorized credential access, or malicious command execution was found; the extensive security documentation provided (`SECURITY.md`, `VETTING.md`) accurately reflects the transparent and functional nature of the code.
Capability Assessment
Purpose & Capability
The code and scripts match the stated purpose (routing queries to Exa MCP, local SearX, and Tavily). Required binaries (curl, python3) and optional docker for SearX are reasonable for a search/aggregation skill. However the skill documentation and metadata are inconsistent: the top-level registry metadata lists no required env vars, SKILL.md's metadata lists SEARXNG_URL and TAVILY_API_KEY as required, and _meta.json marks them optional. The 'zero-config / no API key required' claim is true for Exa MCP but Tavily integration still needs a key if you want AI summaries — the messaging around 'zero-config' vs optional features is confusing and should be clarified.
Instruction Scope
Runtime instructions and scripts (search.sh, deploy-searx.sh) are narrowly scoped to building/using search results: they read ~/.openclaw/.env, call remote search endpoints, optionally deploy a local SearX instance via Docker, and output to terminal. There is no evidence the scripts read unrelated system paths (e.g., ~/.ssh, ~/.aws). Caveat: search.sh contains a fallback that exports all key=value pairs from ~/.openclaw/.env (export $(cat ~/.openclaw/.env | ... | xargs)), which will indiscriminately export any variables present in that file — review that file before running. Also note that networked queries are sent to third-party services (https://mcp.exa.ai and https://api.tavily.com) so search terms (which may include sensitive info) will be transmitted unless you force SearX/local mode.
Install Mechanism
No install spec is provided (instruction-only install), which minimizes automatic disk writes. Code files are bundled and intended to be executed by the user/agent; deploy-searx.sh uses a public Docker image (searx/searx) and writes a local settings.yml in the skill directory. No downloads from obscure hosts or URL shorteners are used by the scripts themselves, though documentation contains an optional curl example to a public GitHub raw URL. Overall install mechanism is conventional but executing bundled scripts still carries normal code-execution risk.
Credentials
Requested credentials are limited to an optional TAVILY_API_KEY (for Tavily summaries) and an optional SEARXNG_URL (for a local SearX). That is appropriate for the stated integrations. However metadata inconsistencies (some files claim no required env, SKILL.md lists them as required, _meta.json marks them optional) create confusion. The skill's behavior of sourcing ~/.openclaw/.env (and falling back to exporting every KEY=VALUE line) means any secrets you place in that file will be available to the script environment; the author asserts keys are not uploaded, and Tavily calls use the key only in the Authorization header, but you should ensure you only store the intended variables in that .env file.
Persistence & Privilege
The skill does not request 'always' privilege and does not modify other skills or system-wide configurations. deploy-searx.sh writes config under the skill directory and runs a Docker container (normal behavior for an optional local service). Nothing indicates the skill tries to gain persistent elevated privileges or to change other skills' settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install smart-search - After installation, invoke the skill by name or use
/smart-search - Provide required inputs per the skill's parameter spec and get structured output
Version History
v4.1.0
v4.1.0: SearX 1.1.0 + Tavily 双引擎架构，智能场景识别，一键部署
v4.0.1
v4.0.1: 安全优化 - 添加完整权限声明、安全白皮书、外部端点验证说明
v4.0.0
v4.0: Exa MCP 免费无限搜索，零配置，7 大类隐私保护关键词
v3.0.4
v3.0.4: Fixed English description. Set readme to SKILL.en.md for international users.
v3.0.3
v3.0.3: Fixed readme configuration for bilingual support. Added readme_en field for English documentation.
v3.0.2
v3.0.2: Security audit passed. Removed all placeholder keys. No hardcoded secrets. Safe for distribution. Triggering rescan.
v3.0.1
v3.0.1: Security audit passed. Removed all placeholder keys. No hardcoded secrets. Safe for distribution.
v3.0.0
v3.0.0: Added English support for global users. Bilingual documentation (EN/ZH). SearX 1.1.0 + Tavily dual-engine architecture.
v2.0.2
v2.0.2: 移除备用 Key 逻辑，简化配置，开箱即用
v2.0.1
v2.0.1: 修复环境变量加载问题，Tavily 检测逻辑优化
v2.0.0
v2.0.0: SearX 1.1.0 + Tavily 双引擎架构，智能场景识别，一键部署
v1.0.1
Security fix: removed cross-skill dependencies, now uses pure curl for Tavily API calls. Fixed environment variable loading to only read required variables instead of entire .env file.
v1.0.0
- Initial release of smart-search skill.
- Automatically chooses between SearXNG and Tavily based on query type.
- Implements a fallback: switches to Tavily if SearXNG is unstable.
- Supports user-specified engine selection.
- Designed to optimize both search quality and token usage for Chinese web queries.
Metadata
Frequently Asked Questions
What is Smart Search?
免费无限搜索！Exa MCP（主力·零配置）+ SearX（隐私）+ Tavily（AI 摘要），面向大众，无需 API Key。 It is an AI Agent Skill for Claude Code / OpenClaw, with 593 downloads so far.
How do I install Smart Search?
Run "/install smart-search" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Smart Search free?
Yes, Smart Search is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Smart Search support?
Smart Search is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Smart Search?
It is built and maintained by Lee920311 (@lee920311); the current version is v4.1.0.
More Skills