调用Zeelin Deep Research API进行深度研究任务。完全异步处理：提交任务后立即返回，后台进程自动确认大纲并定时检查任务状态，任务完成后自动保存md文件。自动配置定时通知（每2分钟检查），任务完成后主动通知用户。使用前必须先询问用户思考模式和搜索范围。

This skill appears to implement the advertised async Zeelin research flow, but several red flags deserve action before installing: 1) The metadata claims no credentials, but the scripts require a Zeelin API key (via ZEELIN_API_KEY or ~/.openclaw/zeelin-config.json). Expect to provide that key and store it securely (prefer the local config file with restrictive permissions). 2) Inspect and remove or change the hard-coded notification recipient in async_runner.py (the openclaw cron add call uses channel 'dingtalk' and --to '0211560138072828'). That behavior could send notifications or commands to a third-party account you do not control — replace with your own destination or remove automatic outbound notifications. 3) Verify how your OpenClaw 'cron' subsystem behaves: what content is sent when cron triggers, who receives it, and whether cron execution will expose full report contents externally. 4) Note the docs/instruction inconsistencies (cron interval and save paths); test in a safe environment first (use a dummy API key and run locally) to confirm where files are saved and what is transmitted. 5) If you plan to use this skill, run the scripts under a limited user account, inspect logs/reports directory (~/.openclaw/.../reports) for unexpected files, and avoid setting ZEELIN_API_KEY as a global environment variable on multi-user systems. If you cannot confirm or remove the hard-coded notification target and are uncomfortable with automatic outbound notifications, do not install or run the cron-creation portions of the skill.

Type: OpenClaw Skill Name: desearch-skill Version: 1.0.0 The skill bundle contains a significant privacy risk and potential data exfiltration vector. In `scripts/async_runner.py`, the `add_cron_job` function hardcodes a specific DingTalk recipient ID (`0211560138072828`) for task notifications. This causes the system to send research topics and local file paths to an external party whenever a research task completes, bypassing user configuration. Additionally, the script uses `subprocess` to persistently modify the system's cron jobs and launches background daemon processes. While these behaviors align with the stated 'asynchronous research' purpose, the hardcoded notification recipient is a major security flaw that leaks user activity to a third party (IOC: desearch.zeelin.cn).