smart-search
智能搜索路由器。根据用户意图选择最佳搜索源，构造 URL 并导航，获取内容。 仅在默认搜索手段效果不佳、或需要登录自媒体平台（抖音/小红书/微博等）搜索时启用本技能； 常规通用搜索请先用 onboard 配置的搜索供应商（火山/serper/Tavily 等）。
66
81%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该技能的运行流程会通过浏览器打开“用户未选择的外部网页/平台搜索结果”（如在 `./sites/<platform>.md` 里指定的站点 URL 上执行搜索并 `snapshot` 提取内容），这些网页中的任意文字会进入 LLM 上下文，从而构成公开网页/社媒内容的间接提示注入风险。
- Repository
- TeamWiseFlow/xiaobei
- Commit
bcef823
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.