Unified Search - 统一智能搜索

统一搜索技能！中文用百度，英文用 DuckDuckGo，加密货币用 CoinGecko

This skill appears to do what it says: it runs local Python scripts that scrape Baidu/Bing and call the public CoinGecko API, and it can optionally drive the platform browser. Before installing, consider: 1) auditing any other local skill it depends on (the SKILL.md and unified_search.py expect a 'ddg-search' skill in the workspace) because unified_search will invoke that script via subprocess; 2) these scripts perform web scraping and network calls to public sites (rate limits, CAPTCHAs, or site changes can break behavior); 3) run the skill in an isolated or test workspace if you want to inspect runtime behavior (it executes local code with your agent's privileges); and 4) no secrets are requested by this skill, but if you later add features that require API keys, re-evaluate proportionality. Overall the package is coherent with its stated purpose.

Type: OpenClaw Skill Name: unified-search Version: 2.0.0 The skill is classified as suspicious due to a shell injection vulnerability present in the `example_usage.js` file and demonstrated in `SKILL.md`. The `exec` primitive is used to run Python scripts by directly embedding user-controlled `query` input into a shell command string (e.g., `python scripts\baidu_search.py "${query}"`). This allows an attacker to inject arbitrary shell commands if the `query` variable contains shell metacharacters, leading to potential remote code execution on the agent's system. The Python scripts themselves correctly use `subprocess.run` with a list of arguments, which prevents shell injection, but the `exec` primitive in the OpenClaw environment is vulnerable as demonstrated.