Web Search Plus

Unified search skill with Intelligent Auto-Routing. Uses multi-signal analysis to automatically select between Serper (Google), Tavily (Research), Querit (Mu...

Security Scan

The skill's files and runtime instructions are consistent with its stated purpose (multi-provider web search with auto-routing); it requests only optional provider API keys and uses local caching, but you should be aware of local cache storage and where API keys may be loaded from.

Purpose & Capability

Name/description match the delivered artifacts: Python CLI scripts, README, SKILL.md, and provider integration code for Serper, Tavily, Querit, Exa, Perplexity (via Kilo), You.com, and SearXNG. Required binaries (python3, bash) are reasonable for a Python-based CLI. The optional API keys referenced align with the described providers.

Instruction Scope

Runtime instructions and scripts are scoped to searching: they call provider APIs, implement auto-routing, provide a setup wizard, and include caching/debugging utilities. The scripts auto-load a .env from the skill directory (if present) and write cached search results and provider health into a .cache/ directory — this means user queries and provider metadata are persisted locally. This is expected for the feature set but is a privacy consideration.

Install Mechanism

No install spec — code is instruction-and-script based (no remote download/install). All code is included in the package, so nothing is fetched from arbitrary URLs during install. This is the lowest-risk install model.

Credentials

No required credentials are declared; multiple provider API keys are optional and justified by the skill's multi-provider design. The KILOCODE_API_KEY (for Perplexity via Kilo gateway) and SEARXNG_INSTANCE_URL are optional and make sense. One minor inconsistency for users: troubleshooting refers to pip requirements (pip3 install -r requirements.txt) but a requirements.txt was not listed in the file manifest, so dependency installation details may be incomplete.

Persistence & Privilege

The skill persists results and provider health to a local .cache/ directory (configurable via WSP_CACHE_DIR). It does not request always:true or elevated/system-wide privileges. Autonomous invocation is allowed (platform default) — combine that with persistent caching and optional API keys to consider the blast radius if credentials are present and the skill is used autonomously.

Assessment

This skill appears to do exactly what it says: route queries across multiple search providers. Before installing, consider these practical points: (1) Local cache (.cache/) stores full query text, provider, and timestamps — move it or disable caching if queries are sensitive (set WSP_CACHE_DIR or use --no-cache). (2) The CLI auto-loads a .env file from the skill folder if present; don't place secrets you don't want read there, and ensure .env is gitignored. (3) Several provider API keys are optional — only provide the ones you intend to use. (4) The docs mention installing Python requirements but a requirements.txt isn't present in the manifest; verify dependencies (requests, etc.) before running. (5) Perplexity access is proxied via Kilo (api.kilo.ai) using KILOCODE_API_KEY — if you plan to use Perplexity, review Kilo's privacy/policy. (6) The changelog notes an SSRF issue was fixed in setup.py in earlier versions; use the published 2.9.0 release (or later) and avoid running older untrusted versions. If you want extra assurance, review scripts/setup.py and scripts/search.py locally before running and restrict API keys to least-privilege/test accounts.

Stop choosing search providers. Let the skill do it for you.

This skill connects you to 7 search providers (Serper, Tavily, Querit, Exa, Perplexity, You.com, SearXNG) and automatically picks the best one for each query. Shopping question? → Google results. Research question? → Deep research engine. Need a direct answer? → AI-synthesized with citations. Want privacy? → Self-hosted option.

---

✨ What Makes This Different?

• Just search — No need to think about which provider to use
• Smart routing — Analyzes your query and picks the best provider automatically
• 7 providers, 1 interface — Google results, research engines, neural search, AI answers with citations, RAG-optimized, and privacy-first all in one
• Works with just 1 key — Start with any single provider, add more later
• Free options available — SearXNG is completely free (self-hosted)

---

🚀 Quick Start

# Interactive setup (recommended for first run)
python3 scripts/setup.py

# Or manual: copy config and add your keys
cp config.example.json config.json

The wizard explains each provider, collects API keys, and configures defaults.

---

🔑 API Keys

You only need ONE key to get started. Add more providers later for better coverage.

Provider	Free Tier	Best For	Sign Up
Serper	2,500/mo	Shopping, prices, local, news	serper.dev
Tavily	1,000/mo	Research, explanations, academic	tavily.com
Querit	Contact sales/free tier varies	Multilingual AI search, international updates	querit.ai
Exa	1,000/mo	"Similar to X", startups, papers	exa.ai
Perplexity	Via Kilo	Direct answers with citations	kilo.ai
You.com	Limited	Real-time info, AI/RAG context	api.you.com
SearXNG	FREE ✅	Privacy, multi-source, $0 cost	Self-hosted

Setting your keys:

# Option A: .env file (recommended)
export SERPER_API_KEY="your-key"
export TAVILY_API_KEY="your-key"
export QUERIT_API_KEY="your-key"

# Option B: config.json
{ "serper": { "api_key": "your-key" } }

---

🎯 When to Use Which Provider

I want to...	Provider	Example Query
Find product prices	Serper	"iPhone 16 Pro Max price"
Find restaurants/stores nearby	Serper	"best pizza near me"
Understand how something works	Tavily	"how does HTTPS encryption work"
Do deep research	Tavily	"climate change research 2024"
Search across languages / international updates	Querit	"latest AI policy updates in Germany"
Find companies like X	Exa	"startups similar to Notion"
Find research papers	Exa	"transformer architecture papers"
Get a direct answer with sources	Perplexity	"events in Berlin this weekend"
Know the current status of something	Perplexity	"what is the status of Ethereum upgrades"
Get real-time info	You.com	"latest AI regulation news"
Search without being tracked	SearXNG	anything, privately

Pro tip: Just search normally! Auto-routing handles most queries correctly. Override with -p provider when needed.

---

🧠 How Auto-Routing Works

The skill looks at your query and picks the best provider:

"iPhone 16 price"              → Serper (shopping keywords)
"how does quantum computing work" → Tavily (research question)
"latest AI policy updates in Germany" → Querit (multilingual + recency)
"companies like stripe.com"    → Exa (URL detected, similarity)
"events in Graz this weekend"  → Perplexity (local + direct answer)
"latest news on AI"            → You.com (real-time intent)
"search privately"             → SearXNG (privacy keywords)

What if it picks wrong? Override it: python3 scripts/search.py -p tavily -q "your query"

Debug routing: python3 scripts/search.py --explain-routing -q "your query"

---

📖 Usage Examples

Let Auto-Routing Choose (Recommended)

python3 scripts/search.py -q "Tesla Model 3 price"
python3 scripts/search.py -q "explain machine learning"
python3 scripts/search.py -q "latest AI policy updates in Germany"
python3 scripts/search.py -q "startups like Figma"

Force a Specific Provider

python3 scripts/search.py -p serper -q "weather Berlin"
python3 scripts/search.py -p tavily -q "quantum computing" --depth advanced
python3 scripts/search.py -p querit -q "latest AI policy updates in Germany"
python3 scripts/search.py -p exa --similar-url "https://stripe.com" --category company
python3 scripts/search.py -p you -q "breaking tech news" --include-news
python3 scripts/search.py -p searxng -q "linux distros" --engines "google,bing"

---

⚙ Configuration

{
  "auto_routing": {
    "enabled": true,
    "fallback_provider": "serper",
    "confidence_threshold": 0.3,
    "disabled_providers": []
  },
  "serper": {"country": "us", "language": "en"},
  "tavily": {"depth": "advanced"},
  "exa": {"type": "neural"},
  "you": {"country": "US", "include_news": true},
  "searxng": {"instance_url": "https://your-instance.example.com"}
}

---

📊 Provider Comparison

Feature	Serper	Tavily	Exa	Perplexity	You.com	SearXNG
Speed	⚡⚡⚡	⚡⚡	⚡⚡	⚡⚡	⚡⚡⚡	⚡⚡
Direct Answers	✗	✗	✗	✓✓	✗	✗
Citations	✗	✗	✗	✓	✗	✗
Factual Accuracy	⭐⭐⭐	⭐⭐⭐	⭐⭐	⭐⭐⭐	⭐⭐⭐	⭐⭐⭐
Semantic Understanding	⭐	⭐⭐	⭐⭐⭐	⭐⭐⭐	⭐⭐	⭐
Full Page Content	✗	✓	✓	✓	✓	✗
Shopping/Local	✓	✗	✗	✗	✗	✓
Find Similar Pages	✗	✗	✓	✗	✗	✗
RAG-Optimized	✗	✓	✗	✗	✓✓	✗
Privacy-First	✗	✗	✗	✗	✗	✓✓
API Cost	$$	$$	$$	Via Kilo	$	FREE

---

❓ Common Questions

Do I need API keys for all providers?

No. You only need keys for providers you want to use. Start with one (Serper recommended), add more later.

Which provider should I start with?

Serper — fastest, cheapest, largest free tier (2,500 queries/month), and handles most queries well.

What if I run out of free queries?

The skill automatically falls back to your other configured providers. Or switch to SearXNG (unlimited, self-hosted).

How much does this cost?

• Free tiers: 2,500 (Serper) + 1,000 (Tavily) + 1,000 (Exa) = 4,500+ free searches/month
• SearXNG: Completely free (just ~$5/mo if you self-host on a VPS)
• Paid plans: Start around $10-50/month depending on provider

Is SearXNG really private?

Yes, if self-hosted. You control the server, no tracking, no profiling. Public instances depend on the operator's policy.

How do I set up SearXNG?

# Docker (5 minutes)
docker run -d -p 8080:8080 searxng/searxng

Then enable JSON API in settings.yml. See docs.searxng.org.

Why did it route my query to the "wrong" provider?

Sometimes queries are ambiguous. Use --explain-routing to see why, then override with -p provider if needed.

---

🔄 Automatic Fallback

If one provider fails (rate limit, timeout, error), the skill automatically tries the next provider. You'll see routing.fallback_used: true in the response when this happens.

---

📤 Output Format

{
  "provider": "serper",
  "query": "iPhone 16 price",
  "results": [{"title": "...", "url": "...", "snippet": "...", "score": 0.95}],
  "routing": {
    "auto_routed": true,
    "provider": "serper",
    "confidence": 0.78,
    "confidence_level": "high"
  }
}

---

⚠ Important Note

Tavily, Serper, and Exa are NOT core OpenClaw providers.

❌ Don't modify ~/.openclaw/openclaw.json for these
✅ Use this skill's scripts — keys auto-load from .env

---

🔒 Security

SearXNG SSRF Protection: The SearXNG instance URL is validated with defense-in-depth:

• Enforces http/https schemes only
• Blocks cloud metadata endpoints (169.254.169.254, metadata.google.internal)
• Resolves hostnames and blocks private/internal IPs (loopback, RFC1918, link-local, reserved)
• Operators who intentionally self-host on private networks can set SEARXNG_ALLOW_PRIVATE=1

📚 More Documentation

• FAQ.md — Detailed answers to more questions
• TROUBLESHOOTING.md — Fix common errors
• README.md — Full technical reference

---

🔗 Quick Links

• Serper — Google Search API
• Tavily — AI Research Search
• Exa — Neural Search
• Perplexity — AI-Synthesized Answers (via Kilo Gateway)
• You.com — RAG/Real-time Search
• SearXNG — Privacy-First Meta-Search