Rumor Buster - 双引擎谣言验证

Dual-engine fact-checking skill for verifying news, claims, and messages through Chinese + English cross-verification and source tracing. Use when user wants...

This skill appears to implement what it claims, but proceed with caution: 1) The code contains a hard-coded Tavily API key — remove or replace it and supply your own key if you plan to use Tavily; using the embedded key could expose your queries to the developer and consume their quota. 2) The setup script probes local paths (~/.openclaw/..., /usr/local/..., /opt/...) to detect other installed skills and makes outbound HTTP requests to test search engines and to Tavily — expect network traffic and possible transmission of the search query text to external services. 3) The skill writes ~/.rumor-buster-config (which may contain partially redacted API keys) — review the file before and after first run. Recommended steps before installing: review the tavily_search.py and setup.py sources, remove the default API key or ensure it is not used, run in a controlled environment if you care about privacy, and avoid enabling Tavily (or provide your own key) if you do not trust the external service. If any of these behaviors are unacceptable, do not install.

Type: OpenClaw Skill Name: rumor-buster Version: 0.5.0 The skill contains a hardcoded Tavily API key (tvly-dev-...) in 'scripts/tavily_search.py', which is a significant security vulnerability. Furthermore, the 'sub-skills/setup/setup.py' script performs extensive system and network discovery, including checking for the presence of other installed skills in the workspace and probing multiple external search engine endpoints (e.g., Sogou, Toutiao, DuckDuckGo) to verify connectivity. While these behaviors are functionally linked to the skill's stated purpose of multi-engine fact-checking, the combination of hardcoded credentials and broad environment probing is considered high-risk.