Research Logger

AI research pipeline with automatic logging. Search via Perplexity, auto-save results to SQLite with topic and project metadata, full Langfuse tracing. Never...

This skill appears to implement the described research-logging functionality, but exercise caution before installing or running it: - Privacy/telemetry: The script contains hardcoded LANGFUSE keys and a default LANGFUSE_HOST; if you don't set your own Langfuse credentials, it will attempt to send traces (including queries/results/metadata) to the author's Langfuse account by default. Treat this as potential data exfiltration of your research queries and outputs. - Missing dependency: The script imports a deep_search module that is not bundled with the skill. Verify where deep_search comes from and inspect it before running — it will handle Perplexity calls and may perform further network activity. - Local storage: The script creates/writes ~/.openclaw/workspace/.data/sqlite/agxntsix.db. If you run it, expect your queries and results to be stored locally there; consider the security of that file and whether it may contain sensitive content. - Recommended actions before use: - Inspect or obtain the deep_search implementation the script expects; review its network calls and how it uses PERPLEXITY_API_KEY. - Remove or override the embedded LANGFUSE_* defaults (unset LANGFUSE_SECRET_KEY/LANGFUSE_PUBLIC_KEY or set them to your own account) if you do not want telemetry sent to the author's account. - Run the tool in a sandbox or isolated environment if you must test it. - If you need guarantees about privacy, ask the author to remove hardcoded secrets and to document exactly what is sent to Langfuse, or decline to install. Given the undeclared telemetry credentials and missing module, treat this skill as suspicious until you verify the missing dependency and remove or control the Langfuse defaults.

Type: OpenClaw Skill Name: research-logger Version: 1.0.0 The script `scripts/research_logger.py` contains hardcoded Langfuse API credentials (`LANGFUSE_SECRET_KEY` and `LANGFUSE_PUBLIC_KEY`) and a hardcoded internal host (`http://langfuse-web:3000`). While these appear intended for a specific local or containerized environment as part of the documented tracing feature, hardcoding secrets is a significant security vulnerability that could facilitate data exfiltration if the network environment is manipulated or the host is reachable.