web-claude

Unified web search skill. Fallback order — web_search(Brave) → duckduckgo → claude.ai. Auto-cache search results (saved to memory/research/)

Security Scan

The skill's instructions broadly match a unified web-search purpose, but it omits and assumes permissions/dependencies (Brave API key, Python package, browser session and filesystem writes) that are not declared — these gaps merit caution before installing.

Purpose & Capability

The SKILL.md describes a 3-tier search (Brave web_search, DuckDuckGo via python, and claude.ai browser automation). The skill metadata declares no required env vars, binaries, or installs, yet the instructions explicitly say a Brave API key is required for Tier 1 and the DuckDuckGo fallback uses a python package (duckduckgo_search). Those credentials/dependencies are expected for the stated functionality but are not declared in metadata — a mismatch.

Instruction Scope

Runtime instructions direct the agent to: call a built-in web_search tool, run an external python snippet, automate a browser on port 18800 to access claude.ai, and save full results to memory/research/ files. Saving to disk and automating the user's logged-in claude.ai browser session are within 'search' scope but they access filesystem and an authenticated browser session that the metadata does not mention. The instructions also recommend waits and snapshots which could expose session state; these behaviors should be explicitly declared.

Install Mechanism

There is no install spec (instruction-only), which keeps disk footprint low. However, the DuckDuckGo fallback calls a python snippet that requires the third-party duckduckgo_search package and assumes python is available. The skill does not declare that dependency or provide installation steps — a practical omission rather than an outright malicious indicator.

Credentials

The SKILL.md states Tier 1 "requires Brave API key" and Tier 3 requires a logged-in claude.ai browser, but the registry metadata lists no required environment variables, credentials, or config paths. In addition, the skill will write cached search results to memory/research/ without declaring that path as required. Requesting/using a Brave API key and access to browser sessions would be proportional for this functionality, but they must be declared — their absence is a red flag.

Persistence & Privilege

always:false and normal autonomous invocation are used. The only persistence explicitly described is auto-creating and writing search cache files under memory/research/. Writing user data to disk is within reason for caching, but users should be warned about what gets stored and where. The skill does not request system-wide or other-skills configuration changes.

Scan Findings in Context

[NO_SCAN_FINDINGS] expected: The scanner found nothing because this skill is instruction-only (no code files). Absence of regex findings is not evidence of safety — the SKILL.md itself contains the runtime behavior to evaluate.

What to consider before installing

This skill appears to do what it says (a 3-tier unified search) but it omits some important declarations and assumptions. Before installing or using it: (1) Confirm where and how you will supply a Brave API key (the SKILL.md says it's required but the skill metadata doesn't declare it). Store that key in a secure place and avoid embedding it in logs. (2) Be aware the DuckDuckGo fallback uses a python snippet that requires the duckduckgo_search package and a Python runtime — install and vet that package if you plan to rely on it. (3) Tier 3 automates your local OpenClaw browser (port 18800) and requires a logged-in claude.ai session; automation will interact with your authenticated browser and could expose session-contained data — only enable it if you trust the skill and want automated access to your session. (4) The skill auto-saves search results to memory/research/ — these files may contain sensitive queries or fetched content; review and control that folder or request an option to disable caching. (5) Ask the skill author to update metadata to explicitly list required env vars, dependencies, and the cache path (so you can audit and control them). If you need higher assurance, request a version that declares dependencies and briefly shows the exact commands it will run (or provide an install script that you can review).

Unified Web Search 🐧

Reliable web search via 3-tier fallback strategy: Brave API → DuckDuckGo → claude.ai browser

Search Strategy

Tier 1: web_search (Brave API) — ⚡ Fast and Reliable (Recommended)

Use OpenClaw built-in web_search tool.

web_search(query="search query", count=5, freshness="pw")

Pros:

• Fast response (1-2s)
• Structured JSON results
• freshness parameter support (pd=24h, pw=1 week, pm=1 month)
• search_lang, country parameters for Korean/regional search

Cons:

• Requires Brave API key
• missing_brave_api_key error without key

Tier 2: duckduckgo-search — 🔒 Privacy-focused (Fallback)

Use DuckDuckGo API when Brave fails.

python -c "
from duckduckgo_search import DDGS

with DDGS() as ddgs:
    results = list(ddgs.text('query', region='wt-wt', max_results=5))
    for r in results:
        print(f\"{r['title']}: {r['href']}\")
"

Pros:

• No API key required
• Privacy-friendly
• Various search types (text, news, images, videos)

Cons:

• Lower result quality than Brave
• Request limits (blocks if too many consecutive requests)

Tier 3: web-claude (Browser) — 🧠 Analysis+Search (Last Resort)

Trigger web search in claude.ai browser tab.

1. browser navigate → https://claude.ai/new
2. browser act type → "search question"
3. browser act press → Enter
4. sleep 15-30s
5. browser snapshot → extract response

Pros:

• No API key required
• claude.ai auto web search + analyze + summarize
• Useful for complex research

Cons:

• Slow (15-30s)
• Requires browser (port 18800, openclaw profile)
• Daily message limit (free account)
• Automation detection risk

Auto-fallback Logic

if web_search available:
    try web_search(query)
    if success: return results
    
if web_search failed or unavailable:
    try duckduckgo-search
    if success: return results
    
if both failed:
    fallback to web-claude browser method

Search Results Auto-cache

All search results automatically saved to memory/research/ folder:

Filename Convention:

memory/research/search-YYYY-MM-DD-HH-MM-[keyword].md

Saved Content:

• Search query
• Timestamp
• Search method used (Brave/DuckDuckGo/claude.ai)
• Search results (links + summaries)
• Extracted insights

Example:

# Web Search: AI Agent Market Size

- **Search Time:** 2026-02-14 07:56 KST
- **Search Method:** web_search (Brave API)
- **Query:** "AI agent market size 2026"

## Results

1. **AI Agent Market to Reach $47B by 2030** - TechCrunch
   https://techcrunch.com/...
   - CAGR 43.2% growth forecast
   - Enterprise agents account for 60%

2. **Korean AI Market Exceeds 1 Trillion KRW** - Chosun Ilbo
   https://chosun.com/...
   - Q1 2026 basis
   - Led by generative AI

...

## Insights

- AI agent market growing rapidly
- Enterprise automation is core driver
- Korean market also active

Usage

General Search

"Search for latest AI agent trends"
"Find 2026 Korean SaaS investment status"

→ Auto-attempts Tier 1 Brave → Tier 2 DDG → Tier 3 claude.ai

Force Specific Method

# Brave only
"Search with web_search: AI market size"

# DuckDuckGo only
"Search with duckduckgo: privacy-focused"

# claude.ai browser only
"Analyze with web-claude: complex market research"

Using freshness Parameter

# Last 24 hours news
web_search(..., freshness="pd")

# Last week
web_search(..., freshness="pw")

# Last month
web_search(..., freshness="pm")

Korean Search

web_search(query="query", search_lang="ko", country="KR")

Browser Method (web-claude) Details

Prerequisites

• OpenClaw browser running (port 18800)
• claude.ai logged in (openclaw profile)

Automation Steps

1. browser navigate → https://claude.ai/new (or existing tab)
2. browser snapshot → save targetId
3. Find input field (contenteditable div or textarea)
4. browser act type → enter question
5. browser act press → Enter
6. sleep 15-30s (wait for response)
7. browser snapshot → extract response text
8. Return result to caller + save to memory/research/

Tips

• Clear search intent: Include time keywords like "latest data", "as of 2026", "current"
• Explicit request: Specify "search and tell me"
• Recommend new chat: Prevent previous context pollution
• Automation detection caution: Don't ask consecutive questions too quickly

Integration with Other Skills

competitor-watch

Use this unified search skill when monitoring competitors:

• quick-check: Prioritize web_search
• deep-dive: Combine web_search + duckduckgo
• Complex analysis: web-claude fallback

cardnews

Use search results for card news research:

• Topic research → unified search
• Search results → cardnews content planning

yt-digest

Search for related info after YouTube summary:

• Video topic → additional web search
• Search results → supplementary insights

When to Use Which Method

Situation	Recommended Method
Need fast search	web_search (Brave)
No Brave key	duckduckgo-search
Privacy important	duckduckgo-search
Need analysis+summary	web-claude
Complex research	web-claude
Image/video search	duckduckgo-search
Latest news (24h)	web_search (freshness="pd")

Cautions

• web_search: Requires Brave API key (auto-fallback if unavailable)
• duckduckgo: Blocks if too many consecutive requests (wait 1s between requests)
• web-claude: Daily message limit, requires browser
• Search result cache: memory/research/ folder auto-created

---

🐧 Built by 무펭이 — Mupengism ecosystem skill