← 返回 Skills 市场

alexey-brave-search

Name: alexey-brave-search
Author: alexeyvorobiev

作者 AlexeyVorobiev · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

339

总下载

当前安装

版本数

在 OpenClaw 中安装

/install alexey-brave-search

功能描述

Web search and content extraction via Brave Search API. Use for searching documentation, facts, or any web content. Lightweight, no browser required.

使用说明 (SKILL.md)

Brave Search

Headless web search and content extraction using Brave Search. No browser required.

Setup

Run once before first use:

cd ~/Projects/agent-scripts/skills/brave-search
npm ci

Needs env: BRAVE_API_KEY.

Search

./search.js "query"                    # Basic search (5 results)
./search.js "query" -n 10              # More results
./search.js "query" --content          # Include page content as markdown
./search.js "query" -n 3 --content     # Combined

Extract Page Content

./content.js https://example.com/article

Fetches a URL and extracts readable content as markdown.

Output Format

--- Result 1 ---
Title: Page Title
Link: https://example.com/page
Snippet: Description from search results
Content: (if --content flag used)
  Markdown content extracted from the page...

--- Result 2 ---
...

When to Use

Searching for documentation or API references
Looking up facts or current information
Fetching content from specific URLs
Any task requiring web search without interactive browsing

安全使用建议

Do not provide any API keys or secrets to this skill yet. The README claims a Brave Search API key is needed, but the code simply scrapes search.brave.com and does not read BRAVE_API_KEY — this mismatch could be sloppy documentation or an attempt to collect a key. If you want to use it: (1) inspect the code (search.js/content.js) yourself — they are present and readable — to confirm behavior; (2) run it in a sandboxed environment or throwaway container before granting network access; (3) if you expect an official Brave API integration, ask the author for proof (link to repo or changelog) or prefer a skill that actually uses the official API; (4) if you supplied a key already, rotate it. The owner/metadata also show minor inconsistencies (different owner in _meta.json vs registry owner), which is another reason to verify provenance.

功能分析

Type: OpenClaw Skill Name: alexey-brave-search Version: 1.0.0 The skill bundle provides web search and content extraction functionality using Brave Search and standard web scraping techniques. All code (`content.js`, `search.js`) uses well-known libraries (`jsdom`, `@mozilla/readability`, `turndown`) for HTML parsing and markdown conversion. There is no evidence of malicious intent, such as data exfiltration, unauthorized command execution, persistence mechanisms, or obfuscation. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts. A minor discrepancy exists where `SKILL.md` mentions needing a `BRAVE_API_KEY`, but `search.js` performs direct web scraping of `search.brave.com` and does not utilize an API key; this is a functional oversight rather than a security vulnerability or malicious act.

能力评估

⚠ Purpose & Capability

Name/description advertise 'Brave Search API' and SKILL.md says 'Needs env: BRAVE_API_KEY', yet the code (search.js) builds a public search URL (https://search.brave.com/search?q=...) and scrapes HTML; no API calls or API-key usage are present. Asking for an API key is not justified by the code.

⚠ Instruction Scope

SKILL.md instructs running npm ci and sets a BRAVE_API_KEY requirement, but metadata lists no required env vars and the scripts do not read any environment variables. The runtime instructions therefore diverge from the actual behavior in the included code.

ℹ Install Mechanism

No formal install spec in registry, but SKILL.md tells the user to run 'npm ci' — package.json and package-lock.json are included. Dependencies are common (jsdom, readability, turndown) pulled from npm (moderate risk). Nothing is downloaded from obscure URLs or executed from remote archives.

⚠ Credentials

The README asks for BRAVE_API_KEY although the skill's package metadata does not declare required env vars and the JS files never access process.env; requesting a secret that the code doesn't need is disproportionate and could trick users into supplying credentials unnecessarily.

✓ Persistence & Privilege

Skill is not always-enabled, does not request system-wide config or modify other skills, and contains no autonomously privileged installation behavior. It only runs as-invoked.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install alexey-brave-search
安装完成后，直接呼叫该 Skill 的名称或使用 /alexey-brave-search 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial publish under Alexey namespace

元数据

Slug alexey-brave-search

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题