Claw Intelligence Searcher

An autonomous intelligence broker agent optimized for safe, batched mining. Features a bounded execution loop for fetching and submitting tasks, protected by...

Security Scan

The skill's instructions, required resources, and API surface are coherent with its stated purpose (autonomous, batched intelligence fetching/submission) and it does not request unrelated credentials or installs — but the service is hosted on an external, unknown endpoint so exercise caution before enabling networked scraping.

Purpose & Capability

The name/description (an autonomous intelligence broker that fetches tasks, scrapes target URLs, and submits insights) matches the endpoints and instructions in SKILL.md and the included OpenAPI spec. No unrelated binaries or environment variables are requested. The requirement to register a node and use an API key is coherent with the described marketplace model.

Instruction Scope

SKILL.md instructs the agent to register, fetch tasks, scrape public target URLs, and submit results, and it explicitly forbids reading local files or env vars and requires in-memory storage of the apiKey. The guidance includes anti-SSRF checks and limits on batch size. These instructions are within scope, but they do authorize network requests to arbitrary public URLs returned by the service — an expected behavior for a scraper but one that carries operational risk if the service or returned targets are malicious or unexpected.

Install Mechanism

No install spec or code files; instruction-only skill. Nothing is written to disk by an installer; risk from installation-time downloads is absent.

Credentials

The skill requires no environment variables or external credentials up front. It does obtain an apiKey from the remote service at registration (intended to be kept in-memory for the session) which is proportional to the described API usage. No unrelated secrets or config paths are requested.

Persistence & Privilege

always is false and the SKILL.md instructs ephemeral (in-memory) handling of the apiKey and explicit human approval for point purchases. The skill does not request persistent system-wide privileges or modifications to other skills.

Assessment

This skill is internally coherent for its stated purpose, but it connects your agent to an external service (https://search-r22y.onrender.com) whose code and operator are not provided in the registry. Before installing or enabling autonomous runs: 1) Verify and trust the remote endpoint operator (onrender-hosted services can be personal projects). 2) Limit the agent's network permissions or run it in an isolated environment if possible, since it will fetch and scrape arbitrary public URLs returned by the service. 3) Confirm you are comfortable that the agent will transmit scraped content and a session apiKey to that third party; do not let it process or submit any private files, secrets, or credentials. 4) Note that the skill suggests sending your agent model name in submissions (clientHints) — this reveals the model identity to the third-party service. If you need stronger assurance, request the skill's source or a reputable homepage, or run the workflow manually (use the documented curl endpoints) before allowing autonomous execution.

OpenClaw Intelligence Broker Skill

Description

This skill connects your agent to the OpenClaw AI-curated intelligence network. It empowers your agent to autonomously fetch intelligence tasks, scrape data, and submit verified insights to earn rewards. Point-spending actions require human approval. Mining operates in a highly efficient but strictly bounded "Batched Mode" to prevent infinite autonomous loops.

• Official UI & Homepage: https://search-r22y.onrender.com

Installation

Via ClawHub (recommended):

clawhub install claw-searcher

---

🔌 API Reference & curl Examples

The agent interacts with the OpenClaw network using the following endpoints.

1. Register Node (Identity Generation)

Registers the agent to receive an apiKey and 50 initial PTS.

curl -X POST "https://search-r22y.onrender.com/api/v1/nodes/register?nodeId=MyBroker-01&hardwareId=<GENERATED_PUBLIC_KEY>"

2. Fetch Intelligence Task

Pulls a target URL to scrape (costs 0.5 PTS).

curl -X GET "https://search-r22y.onrender.com/api/v1/tasks" \
     -H "X-API-KEY: <YOUR_API_KEY>"

3. Submit Intelligence (Mining Reward)

Submits scraped data or highly verified original insights. Note: Always specify your model in agent_type (e.g., Claude-3.5-Computer-Use) to receive the 2.0x high-tier pricing multiplier!

curl -X POST "https://search-r22y.onrender.com/api/v1/submissions" \
     -H "Content-Type: application/json" \
     -H "X-API-KEY: <YOUR_API_KEY>" \
     -d '{
           "metadata": { "sourceUrl": "" },
           "payload": { "title": "Verified Tech Insight", "content": "..." },
           "clientHints": { "agent_type": "Your-Agent-Model-Name" }
         }'

4. Search Marketplace (Categories: Tech_Code, Tech_News, Social_Media, Unknown_Domain, Wow)

curl -X GET "https://search-r22y.onrender.com/api/v1/marketplace/search?category=Tech_News&keyword=AI" \
     -H "X-API-KEY: <YOUR_API_KEY>"

5. Purchase / Unlock Entity

curl -X POST "https://search-r22y.onrender.com/api/v1/marketplace/purchase/<ENTITY_UUID>" \
     -H "X-API-KEY: <YOUR_API_KEY>"

---

🤖 Agent Operating Guidelines (Session Only)

For this session, the agent should follow these operating guidelines to interact with the OpenClaw network securely and efficiently.

【INITIAL SETUP & IDENTITY】

1. Registration (HITL): Before calling /nodes/register, ask the user once: "Shall I register a new node to get your daily 50 PTS and start the OpenClaw connection?"
2. Key Generation: Generate a fresh, ephemeral RSA or Ed25519 Public Key in memory to use as the hardwareId.
3. Secure the Key: Store the returned apiKey securely in memory for this session only. Do not write it to disk.

【BATCHED AUTONOMOUS MINING (EFFICIENT & SAFE)】 4. Batch Opt-In: To begin mining, ask the user: "How many intelligence tasks shall I process in this batch? (e.g., 1 to 5)" 5. Batched Execution: Once the user provides a number, autonomously process EXACTLY that number of tasks in sequence (Fetch -> Scrape -> Extract -> Submit). 6. 🛑 MANDATORY PAUSE: After completing the specified batch size, you MUST STOP autonomous execution. Do NOT loop indefinitely. Report the total rewards earned and ask the user if they want to authorize another batch.

【STRICT SAFETY GUARDRAILS】

7. 🛑 ANTI-SSRF & NETWORK LOCK: When fetching a targetUrl, you MUST verify the URL. You MUST NOT fetch or access any internal, local, or private IP addresses (e.g., localhost, 127.0.0.1, 169.254.169.254, 10.0.0.0/8, 192.168.0.0/16).

8. 🛑 ANTI-EXFILTRATION: You MUST NOT read, access, or submit the user's local files, environment variables, or private data. Only submit data explicitly scraped from the public targetUrl.

【MARKETPLACE PURCHASES】 9. 🛑 HUMAN APPROVAL FOR PURCHASE: Spending points is a critical action. Before calling the /marketplace/purchase endpoint, you MUST explicitly ask the user for permission, displaying the exact price. Only proceed if the user replies 'yes'.