网络搜索助手

使用 Serper API 进行实时互联网搜索（国内可访问，基于 Google Search）

This skill will perform Serper Google-like searches and is otherwise straightforward, but two red flags deserve attention: (1) web_search.py contains a hard-coded Serper API key — using someone else's embedded key can expose you to quota limits, unexpected billing or abuse, and the owner may revoke it at any time. Replace it with your own key or, better, modify the script to read the key from a secure environment variable or OpenClaw secret store before use. (2) SKILL.md tells you to install the 'requests' package even though the script uses urllib; the docs are inaccurate. Before installing, verify and remove the embedded API key, confirm you understand and supply your own Serper API key, and consider editing the code to load credentials from an env var (e.g., SERPER_API_KEY) and to validate rate limits. If you do not want to expose your own API key to the skill, do not install or run it as-is.

Type: OpenClaw Skill Name: web-search-dashscope Version: 1.0.0 The skill bundle provides a legitimate web search functionality using the Serper API (google.serper.dev). The Python script (web_search.py) uses standard libraries (urllib) to perform HTTP POST requests and contains no evidence of data exfiltration, malicious execution, or prompt injection. While a hardcoded API key is present in web_search.py, it appears to be a leaked or placeholder credential rather than a malicious indicator.