Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Search Workflow
v1.0.0Standardized search workflow integrating tavily-search, web_search, web_fetch and other search skills. Provides complete search process from query analysis t...
⭐ 0· 166·1 current·1 all-time
byRoma@earthwalking
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Metadata and README claim integration of multiple search engines/skills (tavily-search, web_search, web_fetch, perplexity-search, bgpt-paper-search), but the provided runtime script only calls a single external API (tavily_search). The skill metadata declares no required environment variables, yet the script expects TAVILY_API_KEY. The discrepancy between claimed multi-engine integration and the actual implementation is incoherent.
Instruction Scope
SKILL.md usage is limited to running the included Python script and describes the 5-stage workflow. The instructions do not ask the agent to read unrelated local files or secrets, but they also do not disclose that queries will be sent to an external endpoint (https://api.tavily.com) nor do they document the use of an API key or privacy implications.
Install Mechanism
There is no install spec (instruction-only) and no downloads; the only executable artifact is a small Python script included in the bundle. This is low-risk from an install-download perspective.
Credentials
The Python script reads TAVILY_API_KEY from the environment but the skill manifest does not declare any required env vars. Worse, the script contains a hard-coded default API key ('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'), which is a secret embedded in code. That key may allow the bundled code to send arbitrary user queries to an external service; the skill provides no information about the key's scope or data handling, which is disproportionate and a privacy risk.
Persistence & Privilege
The skill does not request permanent presence (always is false) and does not attempt to modify other skills or system-wide settings. It writes a local markdown file with results, which is expected behavior.
What to consider before installing
This skill will send your search queries to https://api.tavily.com. The included script hard-codes a TAVILY_API_KEY fallback inside the source instead of declaring environment requirements—this is a red flag because a secret is embedded and the manifest doesn't tell you about it. Before installing: (1) treat the skill as 'untrusted network caller'—do not use it with sensitive or private queries; (2) ask the author to remove the hard-coded key and to declare TAVILY_API_KEY in the manifest so you can supply your own key; (3) if you must run it, run in an isolated environment and consider replacing the default key with your own limited-scope key or removing network calls; (4) confirm whether you need the additional search skills (web_fetch, perplexity-search, etc.) because the script currently only calls tavily_search despite claiming multi-engine integration.Like a lobster shell, security has layers — review code before you run it.
latestvk970vm8rs1b3ejh0w825dhhj1s82wqe0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.