免费网页搜索，使用 Bing + Jina.ai 提取内容摘要。无需 API Key，直接可用。适用于快速获取搜索结果和网页内容。

What to consider before installing/use: - Functionally consistent: the script does what the description claims — it fetches Bing results via the Jina.ai proxy (r.jina.ai) and extracts summaries. However, the script requires common CLI tools (curl, jq, python3, bc, grep) even though the skill metadata lists none. Ensure these are available. - Privacy: requests and page content go through r.jina.ai, a third-party service. If you search sensitive URLs or content, that content may be seen or logged by Jina.ai. Avoid using this for confidential data. - Security and robustness: the Python parsing embeds the raw HTTP response into an inline -c string; that is brittle and could break or be abused by specially crafted responses. Consider running the script in a sandbox, or inspect/modify the script to write RESPONSE to a temporary file and have Python read the file (safe quoting), or use a safer parser. - Recommended safeguards: run in an isolated environment, verify/replace the parsing routine to avoid injecting untrusted content into code, add input validation and rate-limiting, and test behavior on varied responses (CAPTCHA, HTML edge cases). If you need production-grade search, prefer official APIs with documented SLAs and privacy terms. - If you want me to: I can (a) produce a safer patched version of the script that avoids embedding raw responses into python -c and declares required binaries, or (b) perform a line-by-line explanation of the current script and the exact commands you should run to sandbox it.

Type: OpenClaw Skill Name: bing-search-free Version: 1.0.0 The skill provides a Bing search interface by proxying requests through the Jina.ai Reader service. While the functionality aligns with its stated purpose, scripts/bing_search.sh contains a significant security vulnerability: it unsafely injects the raw search response into an inline Python script using triple quotes ('''$RESPONSE'''). This allows for potential Remote Code Execution (RCE) if a search result contains specifically crafted content designed to escape the Python string literal and execute arbitrary code.