free_google_search_with_browser

PassAudited by ClawScan on May 1, 2026.

Overview

The artifacts match a Google-search browser automation skill, with only normal user-awareness notes around dependency installation, visible browser/network use, untrusted snippets, and local scraper state.

Install only if you are comfortable running third-party browser-automation packages from this source and sending search queries to Google. Treat returned snippets and links as untrusted web content, and remove scrapling_storage.db if you do not want local scraper state kept.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Search result text could be misleading or contain instructions meant to influence the agent.

Why it was flagged

The skill intentionally passes externally retrieved Google result titles, links, and snippets into the model context.

Skill content
returns structured results suitable for LLM consumption
Recommendation

Treat returned snippets and links as untrusted search results; do not let them override the user's task or safety rules.

What this means

Using the skill will open a visible browser and send the search query to Google.

Why it was flagged

The script uses browser automation and stealth/challenge-handling options to fetch Google search results, but the destination is fixed to Google and the query is URL-encoded.

Skill content
url = f"https://www.google.com/search?q={encoded_query}" ... StealthyFetcher.fetch(url, headless=False, network_idle=True, solve_cloudflare=True)
Recommendation

Use it only for queries you are comfortable sending to Google and monitor the visible browser if needed.

What this means

Future dependency versions could change behavior when installed or updated.

Why it was flagged

The skill depends on several third-party scraping and browser-automation packages using lower-bound version constraints rather than exact pinned versions.

Skill content
scrapling>=0.4.2
curl_cffi>=0.14.0
playwright>=1.58.0
patchright>=1.58.2
Recommendation

Install in a trusted or isolated environment and consider pinning dependency versions if reproducibility matters.

What this means

Local scraper/browser state may remain after a search completes.

Why it was flagged

The fetcher is configured to keep local state in a database file between runs.

Skill content
StealthyFetcher.configure(storage_args={"storage_file": "scrapling_storage.db"})
Recommendation

Delete scrapling_storage.db if you do not want this local state retained.