Google Search Skill
v1.0.0Performs Google searches with rich results including news, images, videos, places, shopping, scholar papers, patents, and search suggestions via Serper.dev API.
⭐ 0· 387·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The code and SKILL.md clearly implement Google searches via Serper.dev and support the advertised search types (web, news, images, videos, places, shopping, scholar, patents, autocomplete). Requiring a SERPER_API_KEY is appropriate for this purpose. However, the registry metadata claims no required env vars / primary credential, which is inconsistent with the implementation.
Instruction Scope
Runtime instructions and scripts only call the Serper.dev API and format results. The SKILL.md explicitly permits using the agent's web_fetch for deeper content on returned links; that is expected for a search skill but means the agent may fetch arbitrary external pages if instructed. The instructions do not ask to read local sensitive files or unrelated environment variables.
Install Mechanism
No download/install spec is present (instruction-only install). All source files are included in the bundle and there are no external URLs or archive extracts. The code uses native fetch and Node.js 18+; there are zero npm dependencies. This is low-risk from an install perspective.
Credentials
The code requires SERPER_API_KEY (process.env.SERPER_API_KEY) and will fail without it — this is proportional and expected. The concern is that the registry metadata did not declare any required env vars or primary credential, which is a manifest inconsistency that could mislead users about secrets required. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system configs, and is user-invocable. It runs on-demand and does not request elevated or persistent privileges beyond network access to the Serper.dev API.
What to consider before installing
This skill appears to do what it says (use Serper.dev to return Google-like results), but the registry metadata omits the required SERPER_API_KEY that the code enforces. Before installing: 1) Confirm you have a Serper.dev API key and are willing to provide it to the agent (export SERPER_API_KEY). 2) Understand that the skill (and the agent via web_fetch) can fetch arbitrary external links returned in results — avoid giving it access to highly sensitive data or long-lived/privileged API keys. 3) Verify you trust the skill author/owner (no homepage provided) and consider creating a dedicated, limited Serper API key or monitoring/rotating the key if you proceed. 4) Note shopping queries consume extra credits; monitor your Serper account balance. The implementation contains no hidden endpoints, obfuscated code, or attempts to read unrelated local files, but the manifest inconsistency should be corrected before trusting automatic installs.Like a lobster shell, security has layers — review code before you run it.
latestvk9731v86n228j51tdyxzsn3pj581yzmh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.