Websearch

v2.0.2

Multi-engine web search across 6 engines: DuckDuckGo, DDG Lite, Yahoo, Yahoo JP, Startpage, and Google (headless Chromium). No API keys required. Returns 10+...

1· 48·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description describe a multi-engine websearch aggregator and the code/README/SKILL.md implement exactly that: HTTP scraping for several engines plus a Playwright-based headless Google scraper. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
Runtime instructions and code only perform web requests to listed search engines and local Playwright browser launches. They do not read arbitrary local files or environment variables. Note: queries are sent directly to external search engines (your IP and query will be visible to those sites), and the Google engine contains explicit anti-bot evasion steps (navigator.webdriver override, automation flags).
Install Mechanism
There is no built-in install spec, but SKILL.md requires pip install playwright and running 'playwright install chromium', which downloads browser binaries from Playwright's distribution. This is expected for headless Chromium use; the download comes from the Playwright project rather than an unknown personal server.
Credentials
The skill does not request environment variables, secrets, or unrelated credentials. Its network activity (HTTP fetches, Playwright launching Chromium) is proportional to its stated purpose.
Persistence & Privilege
The skill does not require always:true and does not request modifying other skills or system-wide settings. It will run network requests when invoked; default agent autonomy is allowed by platform but not an intrinsic risk here.
Assessment
This skill appears to do what it says: local scraping of multiple search engines with a Playwright headless Chromium fallback for Google. Before installing, consider: - Privacy: your queries and IP are sent to external search engines; Startpage offers some privacy but other engines will see your requests. - Operational: Playwright will download Chromium (large binary) and the Google scraper uses anti-bot evasion techniques; this may be fragile and could trigger blocking or violate a search engine's terms of service. - Security posture: the Google headless code uses --no-sandbox and navigator.webdriver overrides which are typical for scraping but reduce isolation—avoid running in highly sensitive, privileged environments; prefer a sandboxed VM or container if concerned. - Rate limits: the skill makes parallel requests; avoid heavy automated runs to prevent IP blocking. If these tradeoffs are acceptable, the skill is internally coherent. If you need stronger privacy, run queries through an anonymizing proxy or omit the Google engine.

Like a lobster shell, security has layers — review code before you run it.

latestvk976kn54g09fevswqd4913z18d847nm8

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments