豆包大模型对话（免费 API，支持联网搜索）

This skill appears to be a small Node script that sends prompts to a third‑party API and requires you to provide DOUBAO_SESSIONID (sent as a Bearer token). Before installing: (1) Confirm the DOUBAO_SESSIONID is safe to use here — it may grant access to your Doubao account; prefer a limited/throwaway token if possible. (2) Verify the API host (doubao-free-api.vercel.app) is legitimate and intended by the publisher — the skill's homepage is doubao.com but the API is hosted on Vercel, which may be a proxy. (3) Ask the publisher to correct registry metadata to declare the required env var and to remove the unnecessary 'curl' requirement, and to clarify whether web-search is actually supported. If you cannot verify these points, avoid supplying production or sensitive credentials to this skill.

Type: OpenClaw Skill Name: doubao-chat Version: 1.0.0 The skill uses an unofficial third-party API endpoint (doubao-free-api.vercel.app) to proxy requests to the Doubao LLM. The script scripts/chat.js requires a sensitive DOUBAO_SESSIONID environment variable, which it transmits as a Bearer token to this non-official Vercel-hosted domain. While the code performs its stated function, the use of a third-party proxy for session credentials presents a high risk of credential harvesting and unauthorized access to the user's Doubao account.