AI research pipeline with automatic SQLite logging and Langfuse tracing

This skill largely does what it says (logs research to a local SQLite DB and can send traces to Langfuse), but there are red flags you should address before running it: 1) The script contains hard-coded Langfuse keys and a default LANGFUSE_HOST — remove these defaults and provide your own keys if you want tracing; embedded secrets can route your data to an external endpoint. 2) SKILL.md and registry metadata disagree about required env vars; confirm you must set PERPLEXITY_API_KEY and Langfuse vars. 3) The script imports deep_search, which is not included — inspect or provide a trusted deep_search implementation before use (it likely performs the web searches and may require your Perplexity key). 4) The script will create and write a DB at ~/.openclaw/workspace/.data/sqlite/agxntsix.db — if that location is sensitive, change it. 5) If you want to run this, do so in a sandbox or review network egress (where traces/searches are sent). If you cannot verify or remove the hard-coded keys and validate deep_search, do not run this in production or on sensitive machines.

Type: OpenClaw Skill Name: agxntsix-research-logger Version: 1.0.0 The skill is classified as suspicious primarily due to hardcoded Langfuse API keys and a host URL (`http://langfuse-web:3000`) within `scripts/research_logger.py`. While `os.environ.setdefault` attempts to use environment variables first, providing default secret keys directly in the code is a significant security misconfiguration and vulnerability, potentially exposing developer credentials. Additionally, the core search functionality relies on an unprovided `deep_search.py` module, which prevents a full security audit of how external API calls (e.g., to Perplexity) are handled and if any further risks are introduced.