Qingbo Search

通过清博开放平台，根据关键词、时间和媒体类型检索并返回相关网络文章标题、链接及发布时间等信息。

This skill appears to do exactly what it says: query the Qingbo-like API using an app_key and app_secret stored in config.json. Before installing, consider: 1) Do NOT commit config.json containing app_key/app_secret to source control — treat them as secrets. 2) Prefer storing credentials in a secrets manager or environment variables rather than an on-disk plaintext file. 3) The code calls the API using http://databus.gsdata.cn:8888 (plain HTTP). Ask the maintainer to use HTTPS (or verify the service requires HTTP) to avoid sending credentials in cleartext. 4) Verify the API hostname and provider (databus.gsdata.cn) are the legitimate Qingbo endpoint you expect. 5) If you must use this skill on sensitive networks, audit network egress rules or run it in an isolated environment. If the maintainer provides an updated version that uses HTTPS and documents secure credential handling, the security concerns would be largely resolved.

Type: OpenClaw Skill Name: qingbo-search Version: 1.0.1 The skill bundle is benign. It implements an article search function by interacting with the Qingbo Open Platform API. The code reads API credentials from a local `config.json` file, constructs API requests using `node-fetch` to a hardcoded legitimate endpoint (`http://databus.gsdata.cn:8888/api/service`), and processes user input for search parameters using regex. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts in `SKILL.md` or `README.md`, or any other intentional harmful behavior. All actions are aligned with the stated purpose of searching articles.