集成智谱搜索、DuckDuckGo 搜索和多模型结构化提取的完整工作流。

这项技能确实能做它宣称的事情（整合智谱/ DuckDuckGo 与 langextract），但注意： - conf.json 中包含多个 apiKey 占位符（ZHIPU_SEARCH_API_KEY、VOLCENGINE_API_KEY 等）。该脚本会尝试从 conf.json 的字符串或对应的环境变量读取这些密钥，但 SKILL 元数据没有声明需要哪些环境变量。安装前请不要把真实凭据直接写入项目文件。优先通过操作系统环境变量注入密钥，并确认 conf.json 不包含明文密钥。 - 在使用前检查并理解 conf.json 的所有键，确认你只提供必要服务的凭据（例如只启用 DuckDuckGo 时不需要智谱/火山引擎的密钥）。 - 仔细审阅 scripts/search.py 和 langextract_wrap.py（它们会使用 openai/zai-sdk/langextract 等客户端），并在隔离环境或受控网络中首次运行以观察对外请求的目的地（这些请求会发往智谱、火山引擎或其他后端）。 - 如不需要某些后端，禁用相应 conf.json 节点（enabled: false）。避免将敏感凭据提交到共享代码库。若需要，我可以帮助你定位 conf.json 中哪些字段必须提供密钥，以及如何以更安全的方式注入凭据。

Type: OpenClaw Skill Name: langextract-search Version: 0.1.5 The skill integrates Zhipu AI, DuckDuckGo, and Volcengine search with multi-model structured extraction. All network calls to external search and LLM APIs (Zhipu, DuckDuckGo, Volcengine, OpenAI-compatible endpoints) are aligned with the stated purpose. API keys are securely handled by resolving environment variables via `os.getenv` from values specified in `conf.json`. File system access is limited to creating an `output` directory and saving search results and extracted information as markdown and JSON files. The `SKILL.md` documentation provides standard usage instructions and does not contain any prompt injection attempts against the OpenClaw agent. While the LLM extraction prompt could theoretically be influenced by malicious search result content (a general LLM vulnerability), the prompt itself is benign, aiming for summarization and key point extraction, and does not instruct the agent to perform harmful actions. The `safesearch: off` setting for DuckDuckGo is a configuration choice, not a security vulnerability or malicious behavior.