Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
WebSearch
v1.0.0Performs a web search using a local SearXNG instance and returns raw search results for the given query.
⭐ 0· 1.6k·21 current·22 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description state the skill will call a local websearch helper for SearXNG and the skill.yaml plus SKILL.md require and call /usr/local/bin/websearch. No unrelated credentials, binaries, or installs are requested.
Instruction Scope
Instructions strictly describe invoking the local websearch command with the query and returning raw results. This stays within scope, but the runtime executes an external binary under the host account: that binary (or the SearXNG instance it talks to) could access network, read files, or log/forward queries. The SKILL.md does not mandate input sanitization or additional checks.
Install Mechanism
No install spec is present (instruction-only), so nothing is written to disk by the skill itself. This minimizes installer risk. The only runtime action is invoking an existing local binary.
Credentials
The skill requests no environment variables, credentials, or config paths—appropriate for a wrapper that calls a local helper. There are no disproportionate secret requests. Note: network access to the SearXNG instance is necessary at runtime but is not requested via env vars.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request persistent presence or modification of other skills or system-wide settings.
Assessment
This skill is coherent with its description, but it relies on the presence and behavior of /usr/local/bin/websearch and on a reachable SearXNG instance. Before installing/using it: 1) verify the binary's provenance (owner, checksum, and source) and inspect it if possible; 2) run the binary manually with test queries to confirm expected behavior; 3) ensure the SearXNG instance is the one you control (queries may be logged or forwarded); 4) confirm the OpenClaw sandbox and host network policies limit what that binary can do (to reduce exfiltration risk); and 5) consider wrapping or replacing the binary with a small vetted script that enforces input validation and restricts network/file access if you need stronger guarantees.Like a lobster shell, security has layers — review code before you run it.
latestvk978byv1cp8avbw4w8chqr8mtx81zvvs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.