Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Google Search

Search the web using Google via AceDataCloud API. Use when searching for web pages, images, news, maps, local places, or videos. Supports localization, time...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 46 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name and description (Google search via AceDataCloud) align with the SKILL.md instructions which call https://api.acedata.cloud/serp/google and describe parameters and response structure.
Instruction Scope
Instructions are scoped to making network requests to AceDataCloud's SERP API and optionally installing a helper package. They only reference a single API token (ACEDATACLOUD_API_TOKEN) and do not instruct reading unrelated files or system credentials.
Install Mechanism
This is instruction-only (no install spec). SKILL.md suggests an optional pip install (mcp-serp) and a hosted endpoint; installing arbitrary PyPI packages carries normal risks but is optional here. No direct downloads or extract steps are present.
!
Credentials
SKILL.md explicitly requires ACEDATACLOUD_API_TOKEN, but the registry metadata lists no required env vars / primary credential. That discrepancy (token required at runtime but not declared) is a provenance/configuration mismatch and could confuse permission gating or automated reviews.
Persistence & Privilege
Skill is not always-enabled and does not request elevated persistence. Agent-autonomous invocation is allowed by default (not a red flag on its own) and nothing in the skill attempts to modify other skills or system-wide settings.
What to consider before installing
This skill appears to be a wrapper for a third‑party Google SERP proxy (acedata.cloud). Before installing: 1) Verify the publisher and provenance — there is no homepage and the source is unknown. 2) Expect to provide ACEDATACLOUD_API_TOKEN (the SKILL.md requires it) even though the registry metadata doesn't declare it — confirm where that token comes from and its scope/permissions. 3) Treat the optional pip package (mcp-serp) like any third‑party package (review package source and code before installing). 4) If you plan to allow autonomous agent use, limit the token's privileges and consider whether network calls to acedata.cloud are acceptable. 5) Ask the publisher to fix the metadata mismatch (declare required env var and primary credential) or provide an official homepage/docs before trusting the skill.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk97bh3kqmbv6g3r99qyrw3wtb583c7dj

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Google Search (SERP)

Search the web through AceDataCloud's Google SERP API.

Authentication

export ACEDATACLOUD_API_TOKEN="your-token-here"

Quick Start

curl -X POST https://api.acedata.cloud/serp/google \
  -H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "latest AI news", "search_type": "search"}'

Search Types

TypeDescriptionReturns
searchWeb search (default)Organic results, knowledge graph, rich snippets
imagesImage searchImage URLs, titles, sources
newsNews articlesHeadlines, sources, publish dates
mapsMap resultsLocations, coordinates
placesLocal businesses/placesName, address, rating, reviews
videosVideo resultsVideo URLs, thumbnails, duration

Parameters

POST /serp/google
{
  "query": "your search query",
  "search_type": "search",
  "country": "us",
  "language": "en",
  "time_range": "qdr:w",
  "number": 10,
  "page": 1
}
ParameterTypeDescription
querystringSearch query (required)
search_typestringOne of: search, images, news, maps, places, videos
countrystringCountry code (e.g., "us", "uk", "cn", "jp")
languagestringLanguage code (e.g., "en", "zh", "ja")
time_rangestringTime filter (see below)
numberintNumber of results per page
pageintPage number for pagination

Time Range Options

ValuePeriod
qdr:hPast hour
qdr:dPast 24 hours
qdr:wPast week
qdr:mPast month
qdr:yPast year

Response Structure

Web search returns structured data including:

  • organic_results: Main search results with title, link, snippet
  • knowledge_graph: Entity information panel (when available)
  • related_searches: Related query suggestions

MCP Server

pip install mcp-serp

Or hosted: https://serp.mcp.acedata.cloud/mcp

Key tool: serp_google_search

Gotchas

  • Default search type is "search" (web). Always specify search_type for non-web searches
  • Country and language codes affect result localization significantly
  • number controls results per page, not total results — use page for pagination
  • Time range only applies to web search and news, not images or places
  • Image search returns thumbnail and full-size URLs — use full-size for downloads
  • Places search works best with location-specific queries (e.g., "restaurants near Times Square")

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…