Openclaw Search Pro

OpenClaw 搜索增强工具 - 多引擎聚合搜索，获取最新信息。 支持免费搜索引擎（必应/搜狗/360）+ 可选 API（Tavily/百度/Google）。 内容提取、结果去重、智能排序。安全内网访问检查。 关键词：openclaw, search, web, research, productivity,...

What to check before installing: - Inspect the actual scripts (scripts/multi-search.* and scripts/extract.*) before running. Confirm where HTTP requests are sent and that no unrecognized third‑party endpoints are called. - Verify extract.py/js SSRF protections by reading the code that does IP/DNS checks; do not assume the comments are correct. Look for DNS resolution + address comparison logic and ensure it uses safe libraries and fails closed. - Search the codebase for hardcoded remote endpoints, webhooks, or short URLs. If found, verify their purpose and ownership. - The package includes a large vendor tree (node_modules) and a venv. That increases audit surface—prefer running in an isolated sandbox/container or ephemeral VM the first time. - The SKILL.md contained suspicious patterns (base64/unicode control chars). Open the SKILL.md in a plain text editor and remove any hidden characters; confirm there are no hidden instructions or encoded payloads. - Do not paste API keys into files until you confirm the storage path and behavior; prefer environment variables as advised (export TAVILY_API_KEY=...) and set file permissions (chmod 600) if storing locally. - If you rely on this skill for sensitive environments, run it in a network‑restricted sandbox and monitor outbound traffic the first time it runs. Why this is 'suspicious' not 'malicious': The code and dependencies align with the stated search/extraction purpose, and no obvious exfiltration code or download URLs were found in the manifest excerpt. However, contradictory documentation, vendor artifacts, and prompt‑injection patterns in the SKILL.md create ambiguity that requires human review before trusting the package or any secrets.

Type: OpenClaw Skill Name: openclaw-search-pro Version: 0.1.6 The skill bundle contains a significant discrepancy between its documentation and its actual contents. While SKILL.md describes a Python-based search tool and lists several Python scripts (e.g., multi-search.py, extract.py), these files are entirely missing from the bundle. Instead, the bundle is populated with a large Node.js node_modules directory containing libraries like axios and cheerio. While these libraries appear to be legitimate versions, their inclusion in a skill documented as Python-only is highly irregular and constitutes unnecessary bloat or a potential vector for unvetted execution. The meta.json also contains a future-dated timestamp (2026).