📦 Baidu Scholar Search — 技能工具
v1.0.0Academic Literature Search Tool enables the retrieval of both Chinese and English literature, covering various types of literature such as academic journals,...
0· 8·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill claims to be a Baidu Scholar search tool but its instructions and code send queries to a third-party SkillBoss API and require a SKILLBOSS_API_KEY (which is not reflected in the registry metadata) — this mismatch and external data flow merit caution.
评估建议
This skill will send whatever search terms you provide to a third-party service (api.heybossai.com) and requires you to supply SKILLBOSS_API_KEY. Before installing, confirm whether you trust the SkillBoss provider and why the skill advertises Baidu but proxies through SkillBoss. Ask the publisher to clarify the data flow and update the registry metadata to declare SKILLBOSS_API_KEY. If you plan to provide a real API key, verify the service's privacy policy and consider using a scoped/limited key...详细分析 ▾
⚠ 用途与能力
The skill is named and advertised as 'Baidu Scholar Search' (homepage xueshu.baidu.com), but both SKILL.md and the provided script POST search queries to https://api.heybossai.com/v1/pilot (SkillBoss). That may be a legitimate proxy, but the manifest and description do not explain this indirection. Also the registry metadata lists no required environment variables while SKILL.md and the script require SKILLBOSS_API_KEY — an internal inconsistency.
ℹ 指令范围
The runtime instructions and the included shell script are narrow: they take a query and POST it to the SkillBoss API. They do not read unrelated files or system state. However, user search queries (potentially sensitive) are transmitted to a third-party endpoint (api.heybossai.com) rather than directly to Baidu; the SKILL.md does not make that explicit to users.
✓ 安装机制
This is an instruction-only skill with no install spec; it requires only curl (already declared). No downloads or archive extraction occur, which is low install risk.
⚠ 凭证需求
The script requires a single API credential (SKILLBOSS_API_KEY), which is proportionate if the skill uses SkillBoss. However the registry metadata did not declare any required env vars, and the advertised Baidu origin does not justify requiring a SkillBoss API key — an unexplained credential request and provenance mismatch.
✓ 持久化与权限
The skill has default privileges (not always:true) and does not request persistent system-level privileges or modify other skills. Autonomous invocation is allowed (platform default) but is not combined here with elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/17
Initial release of Baidu Scholar Search skill. - Search academic literature (journals, conference papers, dissertations) in both Chinese and English using keywords. - Uses the SkillBoss API Hub for comprehensive search results. - Requires SKILLBOSS_API_KEY environment variable for authentication. - Supports pagination and optional abstract retrieval. - Simple setup and usage via curl commands.
● 可疑
安装命令
点击复制官方npx clawhub@latest install abe-baidu-scholar-search
镜像加速npx clawhub@latest install abe-baidu-scholar-search --registry https://cn.longxiaskill.com