ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Pub Web Search

v1.0.0

Search the web for information, find current content, and look up news articles. And also 50+ models for image generation, video generation, text-to-speech,...

⭐ 0· 179·0 current·0 all-time
by@kirkraman
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (web search + many model types) matches the runtime instructions and example calls to https://api.heybossai.com/v1. The required credential (SKILLBOSS_API_KEY) aligns with the documented API. The extra model capabilities (image, video, TTS, email, SMS, scraping) are described throughout the docs and therefore coherent with the stated scope.
ℹ
Instruction Scope
SKILL.md is instruction-only and contains cURL examples that use the SKILLBOSS_API_KEY to call the provider and may download returned URLs (e.g., image_url, video_url). The instructions do not ask the agent to read unrelated local files or other env vars. Note: executing returned download URLs or scraper models could cause the agent to fetch arbitrary external resources; this is expected for a web-search/scraping integration but has operational/privacy implications.
✓
Install Mechanism
No install spec or code to write to disk; instruction-only skill with only example shell commands. This minimizes install-time risk.
ℹ
Credentials
Only one env var (SKILLBOSS_API_KEY) is required and that matches the provider. However, the documented API consolidates access to many backend capabilities (sending email/SMS, scraping, many paid models), so a single key may grant broad actions and billing capacity—users should ensure the key's privileges and billing limits are appropriate.
✓
Persistence & Privilege
always is false and there is no install-time persistence. The skill does not request elevated platform privileges or cross-skill config access.
Assessment
This skill is coherent with its documentation and only requires one API key. Before installing: verify the provider (api.heybossai.com) and its trustworthiness (no homepage was provided), restrict the API key's permissions and billing limits if possible, avoid using high-privilege/production keys for testing, and be aware the skill can trigger downloads and use backend features (email/SMS/scraping) which could have privacy, cost, or legal implications. If you need stronger assurance, ask the author for a homepage/privacy policy, a scoped API key option, or a vendor SLA.

Like a lobster shell, security has layers — review code before you run it.

latestvk9733pybz864g5jkbp0kapacg982rb0e

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvSKILLBOSS_API_KEY
Primary envSKILLBOSS_API_KEY

Comments