Chinese Search Enhancement

Chinese search enhancement: search Baidu, Zhihu, and WeChat articles. Returns AI-optimized structured results in Chinese. Paid skill (0.001 USDT/call via Ski...

This skill appears to implement the claimed searches, but I recommend caution before installing or enabling it broadly: - Do not assume SKILL.md's 'no local files' claim is accurate: the skill reads identity files and will send an identifier (deviceId or hostname+username) to the billing endpoint. - The code contains a hardcoded billing API key (lib/billing.mjs). That is a secret embedded in distributed code — it could be abused by the publisher or an attacker who modifies the skill. Ask the publisher why the key is embedded and request a safer billing design (server-side charging or per-install keys). - The baidu module falls back to an undocumented third-party free API (v.api.aa1.cn). Ask the publisher to disclose all external endpoints and justify them. - For testing, run the tool locally with the --no-billing flag and monitor network connections (or sandbox it) before giving it network access in production or allowing autonomous invocation. - If you must use it: avoid installing on devices with sensitive local data or identity you don't want sent to an external billing service. Prefer installing only after the publisher removes the embedded API key or provides clear billing documentation and an opt-in consent flow. If you want, I can produce a short message you can send to the publisher asking for: (1) removal of the hardcoded API key, (2) disclosure/justification of v.api.aa1.cn usage, and (3) correction of the SKILL.md claims about local file access.

Type: OpenClaw Skill Name: zhsearch Version: 1.0.0 The skill implements a mandatory pay-per-use billing mechanism (0.001 USDT/call) that collects and exfiltrates system identifiers to a third-party service (skillpay.me). Specifically, search.mjs and lib/billing.mjs resolve a 'callerId' by reading local identity files (~/.openclaw/identity/device.json) or falling back to collecting the system hostname and username (os.hostname, os.userInfo), which are then sent to the billing API. While this behavior is documented in SKILL.md, the collection of host-level identity data for a search utility is a privacy risk and represents a high-privilege tracking behavior.