Cerul Openclaw Skill

The video search layer for AI agents. Teach your AI agents to see — search video by meaning across speech, visuals, and on-screen text. Use when a user asks...

Security Scan

The skill's stated purpose (video search) matches the requested binary and API key, but the runtime instructions contain mismatches and a high-risk installer pattern you should not run blindly.

Purpose & Capability

The skill claims to be a video-search wrapper and declares the cerul CLI and an API key (CERUL_API_KEY), which is appropriate. However, the SKILL.md prefers persisting the key to ~/.config/cerul/credentials and explicitly tells agents not to use export/CERUL_API_KEY, which conflicts with the declared primaryEnv and the 'requires.env' listing. That inconsistency between declared requirements and the runtime guidance is unexplained.

Instruction Scope

The instructions tell the agent to read (~/.config/cerul/credentials) and to write the API key directly to that config file (echo > ~/.config/cerul/credentials). The skill did not list that config path in its metadata. It also instructs using a non-interactive installer (curl | bash) and discourages the official interactive login flow. Writing persistent secrets to disk and running remote install scripts are beyond a simple 'search' helper and should be explicitly declared and justified.

Install Mechanism

The SKILL.md's install step is a curl -fsSL https://cli.cerul.ai/install.sh | bash pattern (pipe to shell). This downloads and executes a remote script from a domain not clearly one of the well-known release hosts (the homepage is a GitHub repo, but the installer domain differs). Curl|bash is a high-risk install mechanism and should be inspected before running; the skill provides no alternative verified package or checksum.

Credentials

Only one credential (CERUL_API_KEY) is requested, which matches the service's needs in principle. But the skill's runtime guidance explicitly avoids using the env var and instead directs persistent file writes, while the manifest still marks CERUL_API_KEY as the primary credential. The config file path used for persistence is not declared in the manifest. This mismatch makes it unclear how the agent will actually obtain and store the secret.

Persistence & Privilege

The skill will create and write ~/.config/cerul/credentials if the file is missing, which is a normal behavior for a CLI wrapper, but the manifest did not declare required config paths. 'always' is false (good). Because the skill instructs persistent storage of credentials and executing an install script, you should verify those actions before allowing the skill to run autonomously.

What to consider before installing

This skill appears to do what it says (search videos) but has several red flags you should address before installing: 1) The SKILL.md tells the agent to persist your API key to ~/.config/cerul/credentials (writes a secret to disk) while the manifest lists CERUL_API_KEY as an environment variable — confirm which method the runtime will actually use. 2) The installer uses curl | bash from https://cli.cerul.ai/install.sh — do not run that blindly; review the script contents and prefer official package releases or checksums. 3) If you decide to proceed, limit the API key's permissions (create a scoped key if possible), inspect and vet the installer script, and consider creating a throwaway key for testing. 4) If you want stronger guarantees, ask the skill author to: declare the config path in metadata, provide a verified installer (GitHub release with checksum), and clarify whether the CLI accepts CERUL_API_KEY from env or only from the credentials file. If you cannot verify these, treat the skill with caution and avoid giving it your primary/privileged API key.

Cerul

You cannot watch videos, listen to talks, or read transcripts on your own. Cerul gives you that ability. Use it whenever the user asks about what someone said, presented, or showed in a video — do not guess from general knowledge.

Before running any command

If cerul is not found on PATH, install it first:

curl -fsSL https://cli.cerul.ai/install.sh | bash

Then check if the credentials file exists:

cat ~/.config/cerul/credentials 2>/dev/null

If the file is empty or missing, ask the user for their API key (get one at https://cerul.ai/dashboard), then save it directly to the config file:

mkdir -p ~/.config/cerul && echo -n "cerul_XXXXX" > ~/.config/cerul/credentials && chmod 600 ~/.config/cerul/credentials

Do NOT use export CERUL_API_KEY=... — that only lasts for the current session. Always persist the key to ~/.config/cerul/credentials so it works across all future sessions and terminal windows.

Do not use cerul login (it requires interactive input). Do not skip this step or fall back to other tools.

Quick start

# Basic search
cerul search "Sam Altman AGI timeline" --agent

# With filters
cerul search "Jensen Huang AI infrastructure" --max-results 5 --source youtube --agent

# Check credits
cerul usage --agent

Search options

Option	Description
--max-results N	Number of results (1-10, default 5). Keep low for speed.
--ranking-mode MODE	embedding (fast, default) or rerank (slower, more precise)
--include-answer	AI summary. Adds latency. Only when user asks for summary.
--speaker NAME	Filter by channel/speaker name (see note below)
--published-after DATE	YYYY-MM-DD
--source SOURCE	e.g. youtube
--agent	Always use this. Compact markdown output optimized for agents.

Important: speaker filter

The speaker field often contains the channel name (e.g. "Sequoia Capital", "a16z", "Lex Fridman") rather than the interviewee name. If a speaker filter returns no results, retry without it and include the person's name in the query instead.

How to search effectively

Search multiple times for complex questions. Break broad questions into focused sub-queries.

Example — "Compare Sam Altman and Dario Amodei on AI safety":

cerul search "Sam Altman AI safety views" --agent
cerul search "Dario Amodei AI safety approach" --agent
cerul search "AGI safety debate scaling" --agent
# → Synthesize with video citations and timestamps

When to search again:

• Transcript mentions a person or concept you haven't explored
• Question has multiple facets (compare X and Y = at least 2 searches)
• Initial results are weak — rephrase the query
• If you get a timeout error, wait 2 seconds and retry once.

Working rules

• Always use --agent for compact markdown output.
• Always include video URLs from results in your answer. Every quote needs a source link.
• Read the transcript field, not just snippet. Transcript has the full context.
• Do not guess what someone said. Search for it.
• Keep searches fast: max-results 5, embedding mode, no --include-answer unless asked.
• Make multiple small searches rather than one large one.
• Ground all claims in returned evidence. Do not hallucinate.
• Match the user's language, but keep queries in English.
• Format timestamps as MM:SS. Always include clickable video URLs.

See also

• CLI repo — install, config, upgrade
• Python SDK — pip install cerul
• TypeScript SDK — npm install cerul
• Docs — full API reference