Google Search Nino

Search the web using Google Custom Search Engine (PSE). Use this when you need live information, documentation, or to research topics and the built-in web_se...

Security Scan

The skill's code and instructions are consistent with a Google Custom Search integration, but registry metadata omits the required environment variables and the packaged script has an undeclared dependency — these mismatches deserve attention before installing.

Purpose & Capability

The name, description, SKILL.md, and scripts/search.py all align: the skill calls Google Custom Search (googleapis.com) and needs an API key and CSE ID. However, the registry metadata lists no required environment variables even though the skill clearly requires GOOGLE_API_KEY and GOOGLE_CSE_ID.

Instruction Scope

SKILL.md instructs the user to enable the Custom Search API, create an API key and CSE ID, and store them in environment variables or a .env file. The runtime script only reads those env vars and performs requests to the Google API — it does not attempt to read unrelated files or exfiltrate data to unexpected endpoints.

Install Mechanism

There is no install spec (instruction-only plus a small Python script). The script imports the third‑party 'requests' library, but the skill metadata does not declare dependencies; this is an operational mismatch (the runtime will require Python + requests). No downloads from untrusted URLs are present.

Credentials

The script legitimately requires two credentials (GOOGLE_API_KEY, GOOGLE_CSE_ID) and uses them only to call Google's API. The concern is that the registry metadata did not declare these required env vars or a primary credential, which is an inconsistency that could lead to user confusion or misconfiguration.

Persistence & Privilege

The skill does not request always:true and does not modify system-wide settings. It runs on-demand and has no elevated persistence or cross-skill configuration changes.

What to consider before installing

This skill appears to do what it says (call Google Custom Search) and the included script only sends queries to googleapis.com. Before installing: (1) verify the owner you trust — the _meta.json ownerId differs from the registry ownerId in the listing; (2) be aware you must provide GOOGLE_API_KEY and GOOGLE_CSE_ID (the registry metadata didn't declare these); (3) ensure your environment has Python and the 'requests' package or add that dependency explicitly; (4) store the API key securely and grant it only the minimal permissions needed. If you need higher assurance, ask the publisher to fix the metadata (declare required env vars and dependencies) and explain the ownerId mismatch.

Google Search Skill

This skill allows OpenClaw agents to perform web searches via Google's Custom Search API (PSE).

Setup

1. Google Cloud Console: Create a project and enable the "Custom Search API".
2. API Key: Generate an API Key.
3. Search Engine ID (CX): Create a Programmable Search Engine at cse.google.com, and get your CX ID.
4. Environment: Store your credentials in a .env file in your workspace:

   GOOGLE_API_KEY=your_key_here
   GOOGLE_CSE_ID=your_cx_id_here
   

Workflow

... (rest of file)

Example Usage

GOOGLE_API_KEY=xxx GOOGLE_CSE_ID=yyy python3 skills/google-search/scripts/search.py "OpenClaw documentation"