Web Search Instant

• Analyzed: May 12, 2026, 3:19 AM
• Findings: 1
• Version: 1.1.0
• Hash: c7de706875e087269915e5f7335654d85a442dd6f67ee2179a65d5541608685b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for 'web-search-instant' is benign. The `web-search.sh` script correctly implements a client for the DuckDuckGo Instant Answer API, making network requests only to `https://api.duckduckgo.com` as expected. There is no evidence of data exfiltration, malicious execution (e.g., `eval`, `curl|bash`), persistence mechanisms, or obfuscation. The `SKILL.md` and other documentation files contain no prompt injection attempts against the agent, providing only clear instructions for using the web search functionality. All test scripts (`performance-test.sh`, `test-cases.sh`, `test-new-features.sh`) are also benign, executing the main script locally and using standard shell commands for validation.