← 返回 Skills 市场
ryandeangraves

Brain Search

作者 ryandeangraves · GitHub ↗ · v1.1.0
cross-platform ⚠ suspicious
786
总下载
0
收藏
4
当前安装
2
版本数
在 OpenClaw 中安装
/install brain-search
功能描述
Search, retrieve, log, and manage past conversations, research, and job tasks in Frank's persistent Second Brain knowledge base.
使用说明 (SKILL.md)

Skill: brain-search

CRITICAL RULE — NO FABRICATION

You MUST actually execute every curl command using your shell/exec tool. Read the real HTTP response. NEVER generate a fake response, placeholder ID, or simulated output. If the API call fails, report the actual error to Boss Man. If you cannot execute shell commands right now, say so — do not pretend you ran them.

Purpose

Search and interact with Frank's Second Brain — the persistent knowledge base that stores conversation logs, research, journal entries, job results, and long-term memory.

When to Use

  • Boss Man asks "what did we talk about on Monday?" or "find that research on X"
  • You need context from previous sessions or completed jobs
  • Logging noteworthy activity outside of normal Telegram conversation
  • Checking job queue status or delegating tasks to sub-agents
  • Creating, updating, or managing tasks on the Kanban board

API Base

https://second-brain-chi-umber.vercel.app

All requests require header: x-api-key: frank-sb-2026

Search Entries

Find past conversations, research, notes, and logged activity.

curl -s "https://second-brain-chi-umber.vercel.app/api/entries?q=SEARCH_TERM&limit=10" \
  -H "x-api-key: frank-sb-2026"

Search with Tag Filter

curl -s "https://second-brain-chi-umber.vercel.app/api/entries?q=SEARCH_TERM&tag=TAG_NAME&limit=10" \
  -H "x-api-key: frank-sb-2026"

Common tags: daily-journal, telegram, research, market-analysis, advisory-council

Create Entry

Store a new knowledge entry (research results, analysis, etc.).

curl -s -X POST "https://second-brain-chi-umber.vercel.app/api/entries" \
  -H "x-api-key: frank-sb-2026" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Entry Title",
    "content": "Full content here",
    "tags": ["tag1", "tag2"],
    "source": "telegram-frank"
  }'

Log Activity

Record noteworthy events, decisions, or results.

curl -s -X POST "https://second-brain-chi-umber.vercel.app/api/log" \
  -H "x-api-key: frank-sb-2026" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "ACTION_TYPE",
    "summary": "Brief description of what happened",
    "source": "telegram-frank",
    "details": {}
  }'

Kanban Board — Tasks

Create a Task

curl -s -X POST "https://second-brain-chi-umber.vercel.app/api/tasks" \
  -H "x-api-key: frank-sb-2026" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Task Title",
    "description": "What needs to be done",
    "status": "backlog",
    "priority": "medium",
    "tags": ["tag1"]
  }'

Valid statuses: backlog, in_progress, done Valid priorities: low, medium, high Note: project_id is validated — create projects first via POST /api/projects before referencing them.

Update Task Status (Move on Kanban)

curl -s -X PATCH "https://second-brain-chi-umber.vercel.app/api/tasks/TASK_ID" \
  -H "x-api-key: frank-sb-2026" \
  -H "Content-Type: application/json" \
  -d '{"status": "in_progress"}'

List Tasks

curl -s "https://second-brain-chi-umber.vercel.app/api/tasks?status=backlog&limit=20" \
  -H "x-api-key: frank-sb-2026"

Check Activity Log

curl -s "https://second-brain-chi-umber.vercel.app/api/activity" \
  -H "x-api-key: frank-sb-2026"

File Storage

Upload a File

curl -s -X POST "https://second-brain-chi-umber.vercel.app/api/upload" \
  -H "x-api-key: frank-sb-2026" \
  -F "file=@/path/to/file.jpg" \
  -F "title=My File" \
  -F "tags=upload,test"

Optional fields: entry_id, title, tags, description. If no entry_id, auto-creates a file type entry.

List Files

curl -s "https://second-brain-chi-umber.vercel.app/api/files?limit=50" \
  -H "x-api-key: frank-sb-2026"

Filters: ?category=image|video|audio|document, ?stats=true

List Attachments on an Entry

curl -s "https://second-brain-chi-umber.vercel.app/api/entries/ENTRY_ID/attachments" \
  -H "x-api-key: frank-sb-2026"

Delete a File

curl -s -X DELETE "https://second-brain-chi-umber.vercel.app/api/attachments/ATTACHMENT_ID" \
  -H "x-api-key: frank-sb-2026"

Job Queue (Delegate to Sub-Agents)

Create Job (Delegate)

curl -s -X POST "https://second-brain-chi-umber.vercel.app/api/jobs" \
  -H "x-api-key: frank-sb-2026" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "JOB_TYPE",
    "title": "Job Title",
    "description": "Detailed instructions",
    "priority": "normal",
    "tags": ["TAG"],
    "input": {}
  }'

Routing Tags for Sub-Agents

Tags Picked Up By Best For
["claude", "code"] Claude Opus 4.5 Coding, architecture, debugging
["claude", "write"] Claude Sonnet 4.5 LinkedIn posts, articles, email drafts
(no claude tag) MiniMax M2.5 Research, analysis, batch ops (cheapest)

Check Job Status

curl -s "https://second-brain-chi-umber.vercel.app/api/jobs/JOB_ID" \
  -H "x-api-key: frank-sb-2026"

List Running Jobs

curl -s "https://second-brain-chi-umber.vercel.app/api/jobs?status=running&stats=true" \
  -H "x-api-key: frank-sb-2026"

Rules

  • EXECUTE EVERY CURL COMMAND FOR REAL — use your shell/exec tool. Never simulate or fabricate API responses.
  • Always include x-api-key: frank-sb-2026 header
  • Always report the actual HTTP response back to Boss Man
  • If an API call fails, show the error — don't make up a success message
  • Boss Man watches the /jobs page and Kanban board live — he will see if you fake it
  • When delegating: create job as pending → sub-agent picks it up → updates to running → completed
  • For multi-step tasks, ALWAYS use the job queue rather than doing everything inline
  • Log activity for anything noteworthy that happens outside of normal Telegram chat
安全使用建议
This skill appears to do what it claims (search/manage a 'Second Brain') but contains two concerning elements: 1) a hardcoded API key (x-api-key: frank-sb-2026) embedded in the instructions instead of being declared as a required credential; and 2) an explicit requirement that the agent must run real shell curl commands — including file uploads that reference local paths — which could allow reading and sending local files to the listed domain. Before installing or enabling this skill: - Ask the publisher why the API key is hardcoded and request a per-user credential (or move the key to requires.env) so you control it. - Confirm you trust the remote host (https://second-brain-chi-umber.vercel.app) and verify ownership/contact info; a homepage or owner info is missing. - If you permit the skill to run, restrict which files it may access and avoid granting broad shell/exec permission if you cannot trust the service. - If you need stronger assurance, request that the skill be rewritten to accept an env-provided API key and to use platform-native API adapters rather than instructing the agent to run arbitrary curl commands. If the publisher cannot justify the shared embedded key and the need to read/upload local files, treat the skill as unsafe to enable.
功能分析
Type: OpenClaw Skill Name: brain-search Version: 1.1.0 The skill is suspicious due to two primary reasons: 1) It explicitly provides an API endpoint (`POST /api/upload`) that allows the agent to upload arbitrary local files (e.g., `@/path/to/file.jpg`) to `https://second-brain-chi-umber.vercel.app`. This creates a significant data exfiltration risk if the agent can be prompted to upload sensitive files (e.g., credentials, private keys). 2) The `SKILL.md` contains strong instructions like 'CRITICAL RULE — NO FABRICATION' and 'EXECUTE EVERY CURL COMMAND FOR REAL', which make the agent highly susceptible to prompt injection. If user input can influence the `curl` commands, it could lead to arbitrary command execution or further data exfiltration, leveraging the agent's willingness to execute shell commands. While the skill itself doesn't contain malicious payloads, it provides critical capabilities that are highly vulnerable to exploitation.
能力评估
Purpose & Capability
The documented API endpoints (search, create entries, tasks, files, jobs) match the skill's stated purpose of searching and managing a 'Second Brain'. However: the SKILL.md embeds an x-api-key value directly in every example rather than declaring it as a required credential; that is inconsistent with the registry metadata (which lists no required env vars) and is unusual for a per-user secret.
Instruction Scope
The instructions explicitly require the agent to execute real shell curl commands (not simulated) and to read and upload local files (examples use -F "file=@/path/to/file.jpg"). That means the skill's runtime behavior may read arbitrary local filesystem paths and transmit their contents to the remote host. The SKILL.md gives the agent broad discretion (always execute, always report HTTP responses) which increases the risk of unintended data disclosure.
Install Mechanism
No install spec or code files are included — instruction-only skills are lower risk in terms of writing/executing third-party code locally. There is no download or package installation that would increase risk.
Credentials
The document requires a header x-api-key: frank-sb-2026 for every request, which is a credential-like value embedded directly in SKILL.md rather than declared in requires.env or primary credential. This is disproportionate/unusual: a secret should be declared as an environment requirement or obtained per-user. A hardcoded, shared API key in the skill is a red flag (possible misuse, shared credential, or exfiltration target).
Persistence & Privilege
The skill does not set always: true and does not request system-wide config changes. It can be invoked autonomously (default), which is normal; combined with the earlier concerns (embedded key + shell execution + file upload), autonomous invocation increases potential blast radius if the skill is granted runtime exec privileges.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install brain-search
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /brain-search 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.1.0
**Major update emphasizing strict execution and new capabilities:** - Added a critical rule: All curl commands must be executed for real—no simulated or fabricated responses. - Introduced Kanban board/task management features: create, update, and list tasks. - Expanded file storage/handling documentation: upload, list, and delete file attachments. - Added explicit instructions for error handling and reporting actual API responses. - Clarified multi-step job delegation and sub-agent routing. - Updated rules to reflect live monitoring by Boss Man and strong anti-fabrication standards.
v1.0.0
Initial release of the brain-search skill for Frank’s Second Brain. - Enables searching and filtering of conversation logs, research, journal entries, and job records via API. - Supports logging new activity and creating persistent knowledge entries. - Allows creation, delegation, and monitoring of jobs for sub-agents with tag-based routing. - Provides clear instructions and API usage examples for all core operations. - Enforces consistent use of API key and stresses using the job queue for multi-step tasks.
元数据
Slug brain-search
版本 1.1.0
许可证
累计安装 4
当前安装数 4
历史版本数 2
常见问题

Brain Search 是什么?

Search, retrieve, log, and manage past conversations, research, and job tasks in Frank's persistent Second Brain knowledge base. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 786 次。

如何安装 Brain Search?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install brain-search」即可一键安装,无需额外配置。

Brain Search 是免费的吗?

是的,Brain Search 完全免费(开源免费),可自由下载、安装和使用。

Brain Search 支持哪些平台?

Brain Search 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Brain Search?

由 ryandeangraves(@ryandeangraves)开发并维护,当前版本 v1.1.0。

💬 留言讨论