Web Search by Desearch

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent web-search skill that calls Desearch’s API with a user-provided key; users should be aware that searches may be sent to Desearch and use account quota.

This skill appears safe and purpose-aligned for web search. Before installing, make sure you are comfortable giving it access to a Desearch API key and sending search terms to Desearch’s service, especially if queries may contain private or sensitive information.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Searches made through the skill may consume the user’s Desearch account quota or balance.

Why it was flagged

The skill requires a provider API key from the user’s environment; this is disclosed and aligned with using Desearch, but it authorizes account usage.

Skill content
key = os.environ.get("DESEARCH_API_KEY")
Recommendation

Use a Desearch key with appropriate account limits and rotate or revoke it if it is no longer needed.

What this means

Search queries are shared with the Desearch service and may be subject to that provider’s logging, retention, and billing policies.

Why it was flagged

The script sends the user’s search query to Desearch’s external API endpoint, which is expected for this web-search function.

Skill content
DESEARCH_BASE = "https://api.desearch.ai"
Recommendation

Avoid sending highly sensitive private information as search queries unless you are comfortable with Desearch’s handling of that data.