← Back to Skills Marketplace
Metaso Search V2
by
xinmh1338863
· GitHub ↗
· v2.1.0
1170
Downloads
0
Stars
5
Active Installs
1
Versions
Install in OpenClaw
/install metaso-search-v2
Description
提供对 Metaso 搜索 API 的直接访问，支持网页搜索、内容读取和智能问答功能
Usage Guidance
This skill appears coherent: it requires only METASO_API_KEY and contacts Metaso endpoints (https://metaso.cn). Before installing, confirm you trust the Metaso service and the skill author (repository/homepage is empty), limit the API key's scope if possible, store the key securely, and consider testing in an isolated environment. If you need stronger assurance, ask the publisher for a repository URL or signed package so you can review provenance and updates.
Capability Analysis
Type: OpenClaw Skill
Name: metaso-search-v2
Version: 2.1.0
The skill provides access to a third-party search API, handling API keys securely via environment variables and making network calls to hardcoded `https://metaso.cn` endpoints. However, the `metaso-api.js` file, specifically the `readWebPage` function, accepts an arbitrary `url` parameter without robust validation. This creates a potential Server-Side Request Forgery (SSRF) or Local File Inclusion (LFI) vulnerability if the Metaso API (to which the URL is proxied) is susceptible to such attacks, allowing a malicious agent prompt to potentially access internal resources or local files via the Metaso service.
Capability Assessment
Purpose & Capability
Name/description (Metaso search, web reader, chat) match the actual implementation: the code calls Metaso API endpoints and requires only METASO_API_KEY. No unrelated services, binaries, or config paths are requested.
Instruction Scope
SKILL.md contains focused runtime instructions and example usage that map directly to the implemented functions. It does not instruct reading arbitrary local files, other environment variables, or exfiltrating data to unexpected endpoints.
Install Mechanism
There is no install spec (instruction-only install). Code files are provided but no installer or external download is used; risk from install mechanism is low.
Credentials
Only METASO_API_KEY is required and used by the code (Authorization header). The number and nature of environment variables is proportional to the stated purpose.
Persistence & Privilege
Skill is not forced-always, is user-invocable, and does not request elevated/platform-wide privileges or modify other skills' configs. Autonomous invocation is allowed (platform default) and is not combined with other red flags.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install metaso-search-v2 - After installation, invoke the skill by name or use
/metaso-search-v2 - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.1.0
优化技能架构，移除默认API密钥，简化配置管理，更新文档结构
Metadata
Frequently Asked Questions
What is Metaso Search V2?
提供对 Metaso 搜索 API 的直接访问，支持网页搜索、内容读取和智能问答功能. It is an AI Agent Skill for Claude Code / OpenClaw, with 1170 downloads so far.
How do I install Metaso Search V2?
Run "/install metaso-search-v2" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Metaso Search V2 free?
Yes, Metaso Search V2 is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Metaso Search V2 support?
Metaso Search V2 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Metaso Search V2?
It is built and maintained by xinmh1338863 (@xinmh1338863); the current version is v2.1.0.
More Skills