zpw-mianfei-web

Use a local free search engine to find information on the web by fetching results with specified keywords.

This skill is small and its purpose matches its instructions, but exercise caution before installing. Questions to ask the author: what host is 192.168.199.100 and can you make the endpoint configurable (via an env var) rather than a hard-coded LAN IP? Ensure the agent URL-encodes or sanitizes the query before inserting it into a shell command, or better: use an HTTP client API rather than invoking a shell curl to avoid command injection. Do not send sensitive data (passwords, secrets, or private tokens) through this skill until you confirm the local server is trusted. If you run agents in an environment where that IP could reach internal services, understand the SSRF/data-leak risk. If you want this skill, request the author to: (1) make the endpoint configurable, (2) document input encoding/escaping, and (3) prefer non-shell HTTP calls so user input cannot break command quoting.

Type: OpenClaw Skill Name: zpw-mianfei-web Version: 1.0.2 The skill is classified as suspicious due to a critical shell injection vulnerability in SKILL.md, where user-provided search queries are directly interpolated into a bash command string without sanitization. While the use of a hardcoded private IP address (192.168.199.100) suggests a local search service, the lack of input validation allows an attacker to execute arbitrary commands on the host system via the search query.