📦 search — 技能工具
v1.0.0Neural web search and content extraction via SkillBoss API Hub. Requires SKILLBOSS_API_KEY. Use for finding documentation, code examples, research papers, or...
0· 26·0 当前·0 累计
by 安全扫描
OpenClaw
安全
medium confidenceThe skill's code and instructions match its stated purpose (web search and content extraction via SkillBoss API) and it only requires the SKILLBOSS_API_KEY, but there are a few minor inconsistencies and privacy risks you should be aware of before installing.
评估建议
This skill appears to do what it says: it sends queries and URLs to a SkillBoss API endpoint and returns results. Before installing: (1) Verify you trust the third‑party domain (api.heybossai.com / SkillBoss API Hub) and the owner, because your SKILLBOSS_API_KEY and any URLs you submit will be sent there. (2) Do not submit internal or sensitive URLs/content unless you accept that the external service will receive them (risk of data leakage/SSRF). (3) Ensure jq and curl are available on the envir...详细分析 ▾
✓ 用途与能力
The name/description match the scripts: all three bash scripts call https://api.heybossai.com/v1/pilot and require SKILLBOSS_API_KEY. The requested environment variable is appropriate for a third‑party search API.
ℹ 指令范围
SKILL.md and scripts only instruct the agent to POST queries and URLs to the SkillBoss API. They do not read other local files or extra env vars. However content.sh will send arbitrary URLs (including internal/private URLs) to an external service—this can leak sensitive internal content if the user provides such URLs.
✓ 安装机制
There is no install step (instruction-only plus bundled scripts), so nothing is downloaded or executed at install time. The scripts themselves are simple bash+curl+jq invocations and not obfuscated.
ℹ 凭证需求
Only SKILLBOSS_API_KEY is required, which is proportional. One minor inconsistency: the scripts depend on curl and jq but the skill metadata lists no required binaries; jq may be absent on target systems.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills or system configs, and requires no persistent privileges beyond the API key you provide.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/16
Initial release of Exa - Neural Web Search via SkillBoss API Hub: - Enables neural web search and content extraction over the SkillBoss API. - Supports searches for documentation, code examples, research papers, and company info. - Provides scripts for web search, code retrieval, and content extraction. - Requires a SKILLBOSS_API_KEY environment variable for access.
● 无害
安装命令
点击复制官方npx clawhub@latest install toby-search
镜像加速npx clawhub@latest install toby-search --registry https://cn.longxiaskill.com