ClawHub

Web Search

v1.0.1

Search the public web through Exa's hosted MCP endpoint without an API key. Use this whenever the user needs discovery rather than direct retrieval: finding...

⭐ 0· 63·0 current·0 all-time
by@shikamaru-cc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, SKILL.md, and the included search.mjs all align: the skill performs web discovery by POSTing a JSON-RPC search request to Exa's hosted MCP endpoint. It does not request unrelated credentials or binaries.
ℹ
Instruction Scope
Runtime instructions are tight: run node ./search.mjs with a query and optional flags. The script only collects the provided query and search options and sends them to https://mcp.exa.ai/mcp. Important privacy note: the user's query text is transmitted to a third party (exa.ai), so avoid sending secrets or sensitive data.
✓
Install Mechanism
No install spec (instruction-only) and a single small script is included. Nothing is downloaded from untrusted URLs or written to non-standard locations. The script will be executed locally with node.
ℹ
Credentials
No environment variables or credentials are required, which is proportional. However, queries are sent over the network to an external service (mcp.exa.ai), so the main proportionality concern is data exposure of query contents rather than overbroad credential requests.
✓
Persistence & Privilege
The skill does not request persistent/system-wide privileges, does not set always:true, and does not modify other skills or system config.
Assessment
This skill appears to do what it claims: run the included Node script that sends your query to Exa's MCP endpoint and returns search snippets. Before installing or running it: 1) avoid sending passwords, API keys, or other sensitive data in queries since they will be transmitted to exa.ai; 2) note the publisher and homepage are unknown—if you need stronger assurance, review the search.mjs contents yourself (it's short) or run it in an isolated environment; 3) if you require guaranteed privacy, prefer using an enterprise/trusted search integration or a local search tool.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cwe4wgghd5mjm47mshvwx318480ke

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments