smart-research

多引擎搜索 + 多级降级抓取 + 结构化研究结果。零API Key，一键完成搜索+抓取+融合。

This skill implements the advertised search+fetch features, but several red flags merit caution: (1) SKILL.md claims "local execution / no data collection" while the fetch fallback uses external services (r.jina.ai, crawl4ai, markdown.new, defuddle) — those requests will expose target URLs and possibly page contents to those services; verify you are comfortable with that data flow before using it on private/internal URLs. (2) The Execution block references scripts/smart_research.py but the repository manifest shows smart_research.py at the root — fix the script_path or adjust how you invoke it. (3) The skill expects a nonstandard binary 'uv' and uses 'uv pip' in docs; ensure you understand what 'uv' is and trust it before running install commands. (4) Dependency/version inconsistencies between SKILL.md and requirements.txt may cause installation/runtime errors. Recommended steps: review the fetcher implementations (how/when they call external endpoints), run the code in a sandboxed environment or behind a proxy, validate and pin the dependencies you will install, and avoid feeding private/internal URLs to this skill unless you have explicitly audited the remote services it uses.

Type: OpenClaw Skill Name: smart-research Version: 1.0.0 The skill bundle contains a hardcoded local absolute path to a specific user's directory in `smart_research.py` (`/Users/xudequan/...`) for the Playwright executable, which is a significant non-portable flaw and reveals developer environment details. Additionally, the tool exfiltrates user-provided URLs to several third-party web services (r.jina.ai, markdown.new, and defuddle.md) for content extraction; while this aligns with the stated 'Zero API Key' functionality, it introduces privacy risks not fully addressed in the documentation. These issues appear to be unintentional bugs or artifacts of AI-assisted development rather than deliberate malicious intent.