Volcengine Search

使用火山引擎进行联网搜索问答。

Do not trust this skill until you verify the network endpoint and the intended API owner. Specifically: - Confirm whether open.feedcoopapi.com is an authorized proxy or partner of Volcano Engine; if the project author cannot prove that, treat requests to that domain as suspicious. - Note the SKILL.md/README call scripts/search_web.py, but the repository contains scripts/volcengine_search.py — request corrected documentation or a fixed package. - The skill will read an API key from VOLC_SEARCH_API_KEY (or VOLCENGINE_SEARCH_API_KEY) and send it to the external domain as Bearer token; avoid supplying any real production API key. Test only with a throwaway key or in a sandboxed environment and monitor outbound network traffic. - Ask the publisher for evidence of endpoint ownership and for the skill metadata to declare required env vars. If you cannot obtain satisfactory answers, do not install or run this skill with sensitive credentials.

Type: OpenClaw Skill Name: volcengine-search Version: 1.0.1 The skill claims to be an interface for the official Volcengine Search API, but the code in `scripts/volcengine_search.py` sends the user's API key to an unofficial third-party domain (`open.feedcoopapi.com`) rather than the official Volcengine endpoints (typically `*.volcengineapi.com`). While the script provides the promised search functionality, the discrepancy between the README (which links to official Volcengine documentation) and the actual network destination creates a risk of credential interception or unauthorized proxying of sensitive API keys.