← 返回 Skills 市场
proxy-web-search
作者
whyhit2005
· GitHub ↗
· v1.0.2
· MIT-0
355
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install proxy-web-search
功能描述
Proxy Web Search Tool - Performs web searches via the OpenClaw Manager proxy. Use when: - Need to search the web for latest information, news, or real-time d...
安全使用建议
This skill appears to do exactly what it says: post search queries to a configured proxy. Before installing, verify the WEB_SEARCH_PROXY_URL you will use points to a trusted OpenClaw Manager proxy (not an arbitrary public URL), because that proxy will receive the full query (including any sensitive text) and will handle API keys. Also ask the publisher/registry to fix the metadata mismatch (the script and SKILL.md require WEB_SEARCH_PROXY_URL but the top-level registry summary listed none). Avoid sending passwords, tokens, or other secrets as search queries, and ensure curl is available on your runtime host.
功能分析
Type: OpenClaw Skill
Name: proxy-web-search
Version: 1.0.2
The skill provides a utility for performing web searches via a proxy, but it contains a JSON injection vulnerability in `scripts/proxy_search.sh`. While the script attempts to escape the search query, it fails to sanitize or escape other command-line arguments such as `--engine`, `--count`, and `--recency` before embedding them into a JSON payload. This allows for the injection of arbitrary keys into the POST request sent to the `WEB_SEARCH_PROXY_URL` endpoint, which is a security flaw in input handling.
能力评估
Purpose & Capability
The skill's name/description (proxy web search) aligns with the included script and SKILL.md: both send JSON search requests to a configured proxy. However, the top-level registry requirements listed in the provided metadata claim no required env vars, while SKILL.md and scripts require WEB_SEARCH_PROXY_URL — this metadata mismatch should be corrected.
Instruction Scope
Runtime instructions and the wrapper script only build a JSON payload from CLI args and POST it to the WEB_SEARCH_PROXY_URL. They do not read other files, credentials, or unrelated env vars, nor do they transmit data to endpoints other than the configured proxy.
Install Mechanism
There is no install spec (instruction-only with an included convenience script). No packages or remote downloads are performed by the skill itself; risk from installation is minimal.
Credentials
The only environment dependency required by the script is WEB_SEARCH_PROXY_URL, which is proportionate for a proxy-based search tool. SKILL.md states the Manager injects API keys from encrypted storage (reasonable). The prior registry summary that listed 'Required env vars: none' is inconsistent with the script and SKILL.md and should be fixed. Also note: queries sent to the proxy will be visible to whoever controls that proxy, so the environment value must point to a trusted Manager instance.
Persistence & Privilege
The skill does not request always:true, does not modify agent/system configuration, and has no elevated persistence needs. It is user-invocable and can be autonomously invoked (platform default) but that is expected for a search skill.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install proxy-web-search - 安装完成后，直接呼叫该 Skill 的名称或使用
/proxy-web-search触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
- Requires the `WEB_SEARCH_PROXY_URL` environment variable to configure the proxy URL (no longer hardcoded to localhost).
- The skill will not be available if `WEB_SEARCH_PROXY_URL` is not set.
- Updated documentation to reflect the new environment variable requirement, including usage examples.
- Explicitly lists `WEB_SEARCH_PROXY_URL` as an environment dependency.
v1.0.1
proxy-web-search 1.0.1
- Updated documentation to clarify that no manual API key configuration is needed; the Manager handles key injection automatically.
- Simplified authentication instructions and removed references to manual `ZHIPU_API_KEY` setup.
- Refined search engine support descriptions for accuracy and clarity.
- Minor text and formatting improvements for better readability.
v1.0.0
- Initial release of the Proxy Web Search skill.
- Supports web searches via the local OpenClaw Manager proxy (port 16782) with automatic API key handling (no manual ZHIPU_API_KEY setup required).
- Allows engine selection (Quark default, Sogou, and others), adjustable result count, time range, domain filtering, and content detail.
- Provides both cURL and script usage examples for easy integration.
- No authentication required—the proxy only listens on localhost and uses the Manager's encrypted secrets store.
元数据
常见问题
proxy-web-search 是什么？
Proxy Web Search Tool - Performs web searches via the OpenClaw Manager proxy. Use when: - Need to search the web for latest information, news, or real-time d... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 355 次。
如何安装 proxy-web-search？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install proxy-web-search」即可一键安装，无需额外配置。
proxy-web-search 是免费的吗？
是的，proxy-web-search 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
proxy-web-search 支持哪些平台？
proxy-web-search 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 proxy-web-search？
由 whyhit2005（@whyhit2005）开发并维护，当前版本 v1.0.2。
推荐 Skills