Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Google Search

v0.1.0

Auto-generated skill for google-search tools via OneKey Gateway.

0· 109·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ai-hub-admin/google-search-onekey-gateway.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Google Search" (ai-hub-admin/google-search-onekey-gateway) from ClawHub.
Skill page: https://clawhub.ai/ai-hub-admin/google-search-onekey-gateway
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install google-search-onekey-gateway

ClawHub CLI

Package manager switcher

npx clawhub@latest install google-search-onekey-gateway
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's code and SKILL.md implement a OneKey Gateway-backed 'google_search' tool (calling a OneKey router that can in turn call Google Custom Search). That aligns with the stated purpose. However the registry metadata at the top claims 'Required env vars: none' and 'Primary credential: none' while SKILL.md declares DEEPNLP_ONEKEY_ROUTER_ACCESS as a required API key — an inconsistency that should be resolved.
Instruction Scope
Runtime instructions are narrowly scoped to invoking the OneKey Gateway (via the CLI or a small Python script). The Python script only reads the provided --data or a JSON file and uses the DEEPNLP_ONEKEY_ROUTER_ACCESS env var. No unrelated system files, other env vars, or unexpected endpoints are referenced in the instructions. Important caveat: SKILL.md and the script route queries through OneKey Gateway — your query payloads will be sent to that service (and onward to commercial APIs).
Install Mechanism
There is no platform-level install spec (skill is instruction-only) which is low-risk, but SKILL.md recommends installing npm package @aiagenta2z/onekey-gateway and Python package ai-agent-marketplace. These are standard registry installs (npm/pip) but the manifest provides no provenance or homepage for the skill owner; you should verify the source of those packages before installing.
!
Credentials
The only secret required by the SKILL.md/script is DEEPNLP_ONEKEY_ROUTER_ACCESS, which is proportionate for a gateway-based search tool. However the registry metadata does not list this required env var (incoherent declarations). Also the script falls back to a shared demo key 'BETA_TEST_KEY_MARCH_2026' if you don't set your own key — using the fallback will route your queries through a shared account and may expose query contents to the gateway operator.
Persistence & Privilege
The skill does not request permanent presence (always: false). It's instruction-only with a small script that runs on demand and does not modify other skills or system-wide settings.
What to consider before installing
Before installing or running this skill: (1) verify the owner and package provenance for @aiagenta2z/onekey-gateway and ai-agent-marketplace (check PyPI/GitHub and package authors). (2) Do not use sensitive secrets or private data with the default demo key — set DEEPNLP_ONEKEY_ROUTER_ACCESS to your own trusted key only if you trust the OneKey Gateway operator. (3) Confirm whether the registry metadata should declare the required env var (the manifest and SKILL.md disagree). (4) If you must test, run in an isolated environment or sandbox and inspect network traffic to understand where queries are sent. (5) If you need higher assurance, request the maintainer to provide source repository/homepage and to remove the fallback demo key behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e8gvjr2a4v7rac0xywpd7ks83cy1m
109downloads
0stars
1versions
Updated 1mo ago
v0.1.0
MIT-0

OneKey Gateway

Use One Access Key to connect to various commercial APIs. Please visit the OneKey Gateway Keys and read the docs OneKey MCP Router Doc and OneKey Gateway Doc.

google-search Skill

Use the OneKey Gateway to access tools for this server via a unified access key.

Quick Start

Set your OneKey access key:

export DEEPNLP_ONEKEY_ROUTER_ACCESS=YOUR_API_KEY

If no key is provided, the scripts fall back to the demo key BETA_TEST_KEY_MARCH_2026. Common settings:

  • unique_id: google-search/google-search
  • api_id: one of the tools listed below

Tools

google_search

Generates google search results by calling google custom search engine API. https://www.googleapis.com/customsearch/v1

    Args:
        query: Annotated[str, "Search Query that User Input"] = "",
        num: Annotated[int, "Return number of search results"] = 10,
        start: Annotated[str, "pagination start index of search item at the number of 0. start=0, num=10 means items from [0, 10), start=10, num=10 means items from [10, 12)"] = 0

    Return:
        results: List[Any], list of search results

Parameters:

  • query (string, optional):
  • num (integer, optional):
  • start (integer, optional):
  • return_fields (array of object, optional):

Usage

CLI

google_search

npx onekey agent google-search/google-search google_search '{"query": "US inflation rate February 2026", "num": 5, "start": 0}'

Scripts

Each tool has a dedicated script in this folder:

  • skills/google-search/scripts/google_search.py

Example

python3 scripts/<tool_name>.py --data '{"key": "value"}'

Related DeepNLP OneKey Gateway Documents

AI Agent Marketplace
Skills Marketplace AI Agent A2Z Deployment
PH AI Agent A2Z Infra
GitHub AI Agent Marketplace

Dependencies

CLI Dependency

Install onekey-gateway from npm

npm install @aiagenta2z/onekey-gateway

Script Dependency

Install the required Python package before running any scripts.

pip install ai-agent-marketplace

Alternatively, install dependencies from the requirements file:

pip install -r requirements.txt

If the package is already installed, skip installation.

Agent rule

Before executing command lines or running any script in the scripts/ directory, ensure the dependencies are installed. Use the onekey CLI as the preferred method to run the skills.

Comments

Loading comments...