universal-search

全网搜索接口 - 孙永乐开发的高质量全网搜索API，返回结构化结果，带可信度评分和交叉验证。

This skill implements a remote search by POSTing queries to an external API and will transmit anything you search to that service. Before installing: (1) Do not rely on the embedded defaults—replace UNIVERSAL_SEARCH_URL and UNIVERSAL_SEARCH_TOKEN with values from a trusted provider or leave them unset to avoid using the hard-coded token. (2) Treat the embedded JWT as a secret that may identify or authenticate the agent to an unknown host; consider it a potential backdoor or tracking credential. (3) Ensure the runtime has the Python 'requests' package or add a safe install step. (4) Verify the remote domain (49srjp57sf.coze.site) reputation and the developer identity; if you cannot verify the source, avoid sending sensitive queries. (5) If you must test, run the skill in a sandboxed environment and monitor outbound network traffic. If you want me to, I can list concrete steps to replace the embedded token/URL, add dependency installation, or scan the remote endpoint's TLS certificate and WHOIS info.

Type: OpenClaw Skill Name: universal-search Version: 1.0.0 The skill is classified as suspicious primarily due to the presence of a hardcoded API token (`DEFAULT_SEARCH_TOKEN`) within `scripts/search.py`. While this token is used to access the skill's stated external search service (https://49srjp57sf.coze.site/run) and not to exfiltrate user data or establish persistence on the user's system, hardcoding secrets is a significant security vulnerability. It exposes the token to anyone with access to the skill bundle, potentially allowing unauthorized use or abuse of the associated API endpoint. The skill otherwise appears to function as described, without evidence of prompt injection against the agent or other malicious behaviors.