Openclaw Smart Search

统一智能搜索技能，整合多个搜索引擎（百炼 MCP、Tavily、Serper、Exa、Firecrawl），自动选择最佳引擎并融合结果

This skill mostly does what it claims (combines multiple search engines) but pay attention to key handling before installing: - Metadata mismatch: the registry summary claims no required env vars but SKILL.md and code require OPENCLAW_MASTER_KEY. Treat OPENCLAW_MASTER_KEY as required. - Inspect where the master key is stored: setup-wizard writes a .env inside the skill directory (./.env). That can expose the master key if the skill directory is not protected. Prefer to set OPENCLAW_MASTER_KEY in your user shell or a proper secret manager and do not leave .env in the repo. - Review src/key-manager.ts before trusting automatic setup: ensure encryption is implemented correctly and that no code transmits keys to external endpoints. Verify the encrypted file (~/.openclaw/secrets/smart-search.json.enc) is created with 0o600 and that the code does not print keys or upload them. - mcporter interaction: the Bailian setup will look for mcporter configs (including /etc paths) and will call mcporter. That is consistent with integrating Bailian but may read other local config files — only run if you expect mcporter integration. - Avoid running setup scripts that auto-generate and write keys until you confirm where they write them and with what permissions. If you run setup, afterwards check file permissions (chmod 600) and remove any stray .env or unencrypted key files. Recommended steps before installing: 1. Inspect src/key-manager.ts and setup scripts for any network calls that might send secrets off-host. 2. Set OPENCLAW_MASTER_KEY in your environment or a dedicated secret manager rather than relying on automatic .env writes. 3. After setup, verify ~/.openclaw/secrets/smart-search.json.enc exists and has 0o600 permissions. 4. If you don't use Bailian/mcporter, skip setup-bailian and only configure engines you trust. If anything seems unexpected, don't proceed and ask the maintainer to clarify the metadata and .env write behavior.

Type: OpenClaw Skill Name: openclaw-smart-search Version: 1.0.14 The skill is a highly professional and security-conscious search aggregator. It implements robust defensive measures, including AES-256-GCM encryption for API keys with PBKDF2 key derivation (src/key-manager.ts), comprehensive input sanitization and injection detection (src/utils/sanitize.ts), and safe external process execution using spawn with shell:false (src/engines/bailian.ts). While scripts/quick-config.sh contains hardcoded API keys, these appear to be the author's own keys provided for testing/demo purposes rather than a mechanism to steal user data. All network traffic is directed to the official APIs of the integrated search services (e.g., api.tavily.com, api.exa.ai, google.serper.dev).