Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

google-search

v1.0.0

Search the web using SkillBoss API Hub. Use this when you need live information, documentation, or to research topics and the built-in web_search is unavaila...

0· 81·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kirkraman/godfery-google-search.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "google-search" (kirkraman/godfery-google-search) from ClawHub.
Skill page: https://clawhub.ai/kirkraman/godfery-google-search
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install kirkraman/godfery-google-search

ClawHub CLI

Package manager switcher

npx clawhub@latest install godfery-google-search
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name/description (web search via SkillBoss API Hub) match the code: the script issues a search request to api.skillbossai.com and returns results. The network calls are coherent with the stated purpose.
Instruction Scope
SKILL.md and the script are narrowly scoped to performing web searches. The runtime only reads the SKILLBOSS_API_KEY env var, posts queries to the SkillBoss API, and prints results; there are no instructions to read unrelated files or exfiltrate other data.
Install Mechanism
This is an instruction-only skill with a small Python script and no install spec — nothing is downloaded or written by an installer. Risk from install mechanism is low.
!
Credentials
The code and SKILL.md require SKILLBOSS_API_KEY (example usage and os.environ["SKILLBOSS_API_KEY"]), but the registry metadata lists no required environment variables or primary credential. That mismatch is a red flag: the skill needs a secret that the registry did not declare. The script will send queries (and thus whatever you search) to the external SkillBoss endpoint, so you should only use a key you trust and that has appropriate scope.
Persistence & Privilege
always is false and the skill does not request elevated or persistent system privileges, nor does it modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined here with other high-risk factors.
What to consider before installing
This skill appears to do what it claims (send queries to SkillBoss and return results) but the registry metadata failing to declare the required SKILLBOSS_API_KEY is inconsistent and should be resolved before installing. Before using: (1) verify the skill owner and source (no homepage provided and owner ID is unknown); (2) confirm the registry metadata is updated to list SKILLBOSS_API_KEY as a required credential; (3) only provide an API key with minimal scope and rotate it if you test the skill; (4) be aware that every query and its contents will be sent to api.skillbossai.com — avoid sending sensitive data. If you need higher assurance, request a signed checksum of the script or an authoritative homepage/repo for review.

Like a lobster shell, security has layers — review code before you run it.

aivk979tj0x67q0est1506cjcv391858dw2latestvk979tj0x67q0est1506cjcv391858dw2
81downloads
0stars
1versions
Updated 6d ago
v1.0.0
MIT-0

Google Search Skill

This skill allows OpenClaw agents to perform web searches via SkillBoss API Hub (unified web search routing).

Setup

  1. SkillBoss API Key: Obtain your API key from SkillBoss API Hub.
  2. Environment: Store your credentials in a .env file in your workspace:
    SKILLBOSS_API_KEY=your_key_here
    

Workflow

... (rest of file)

Example Usage

SKILLBOSS_API_KEY=xxx python3 skills/google-search/scripts/search.py "OpenClaw documentation"

Comments

Loading comments...