media-search

当用户需要写新闻、找素材、查背景、核实信息、了解事件来龙去脉，或者提到"查一下"、"搜一下"、"找找相关报道"、"有什么最新消息"时，或开展互联网线索数据挖掘、新闻选题策划、内容采编、监测竞品或特定信源动态等业务时，需要进行全网媒体稿件检索、查找事件背景、行业数据、政策动态、人物信息、历史脉络等，都应使用此技能

This package appears to be a normal client for a third‑party media API and legitimately needs the two environment variables it requests. Before installing or running it, consider: (1) The code disables TLS verification (requests use verify=False and urllib3 warnings are suppressed) — this weakens transport security and can expose credentials/data to MitM; avoid using it on untrusted networks or modify the code to enable certificate verification. (2) The tool persists an access token and query results in the skill directory (.mbd_token_cache.json and sources/). These files contain tokens, appid and full query results — set restrictive filesystem permissions, keep them out of backups, and delete when not needed. (3) Confirm you trust the API host (mbdapi.fzdzyun.com): credentials you supply will be sent there. (4) The bundle contains executable Python code (not purely instruction-only), so review the code or run in a sandbox if you are uncertain. If you accept these tradeoffs, provide the two environment variables; otherwise, do not install/run the skill or patch the code to enforce TLS and control where tokens/results are stored.

Type: OpenClaw Skill Name: media-search Version: 1.0.0 The skill bundle is a functional tool for searching a media database via the Founder Electronics (fzdzyun.com) API, but it contains security vulnerabilities. Specifically, both `scripts/media_search.py` and `scripts/token_manager.py` explicitly disable SSL certificate verification (`verify=False`), which exposes the agent to Man-in-the-Middle (MITM) attacks when handling sensitive API keys and tokens. While the code follows its stated purpose and lacks clear evidence of intentional malice or data exfiltration, the intentional bypass of standard transport security protocols meets the criteria for a 'suspicious' classification.