Multi-Engine Web Search

Unified multi-engine web search. Use when the user wants to search the web, find information, look up sources, or perform research. Supports Tavily API (fast...

Security Scan

The skill largely matches a web-search tool, but it fails to declare required configuration/credentials and executes external scripts/subprocesses (including reading ~/.openclaw/.env), which is inconsistent and worth caution.

Purpose & Capability

The skill's claimed purpose (multi-engine web search) matches the code and SKILL.md: it uses Tavily API and browser-based search via agent-browser. However the registry metadata lists no required environment variables or config paths while both SKILL.md and the code require/expect TAVILY_API_KEY and read ~/.openclaw/.env — this mismatch is incoherent and should be corrected.

Instruction Scope

The runtime instructions and script direct the agent to read TAVILY_API_KEY from the environment or ~/.openclaw/.env, call out to an external Tavily helper script (../../openclaw-tavily-search/scripts/tavily_search.py) if present, make direct HTTPS calls to api.tavily.com, and run agent-browser subprocesses (open, snapshot, close). Those actions are within the stated purpose but include file reads and arbitrary subprocess execution that were not declared in registry metadata and could execute code outside the skill's bundle.

Install Mechanism

There is no install spec (instruction-only), which is lower risk. The skill does call external tools at runtime (agent-browser, python scripts). The SKILL.md advises installing agent-browser and pip packages but the package itself will attempt to execute those binaries during use; lack of bundled dependencies means runtime failures or unpredictable behavior if those external programs are untrusted or compromised.

Credentials

The code and SKILL.md require a TAVILY_API_KEY (env or ~/.openclaw/.env) but the registry metadata declares no required env vars — this omission is disproportionate and misleading. The skill only needs that one API key for Tavily, which is reasonable for its purpose, but the fact it will read a hidden config file in the user's home directory increases sensitivity and should be declared.

Persistence & Privilege

The skill does not request 'always: true' and does not attempt to persist or modify global agent configuration. It runs subprocesses at runtime but doesn't request elevated or persistent privileges in the registry manifest.

What to consider before installing

This skill appears to implement a sensible multi-engine search, but there are a few red flags you should consider before installing or using it: - The registry metadata does not declare the TAVILY_API_KEY or the ~/.openclaw/.env config file, yet both the SKILL.md and the script read that key — verify the skill owner updates the manifest. Do not assume required credentials are harmless because they are not declared. - The script will execute external programs at runtime: agent-browser (npm tool) and an external tavily_search.py at ../../openclaw-tavily-search/scripts/tavily_search.py if present. That means code outside this skill could be invoked. Before use, inspect any referenced helper scripts (openclaw-tavily-search) and ensure agent-browser is from a trusted source. - The skill may send your TAVILY_API_KEY to https://api.tavily.com during direct API calls. Only provide that key if you trust Tavily and are comfortable placing the key in your environment or ~/.openclaw/.env. Avoid storing highly sensitive credentials in that file unless you control its security. - Runtime network access and subprocess execution are necessary for browser-based scraping; if you need a stricter security posture, run this in an isolated environment or require the agent to prompt before invoking subprocesses. What would change this assessment: if the registry manifest were corrected to declare TAVILY_API_KEY and the config path, and if the package included or documented the exact external helper scripts (so you can review them), the inconsistencies would be resolved and this could be considered benign. If you cannot review the referenced external scripts or you are not willing to provide an API key, treat the skill with caution or avoid installing it.

Web Search

Unified search interface across multiple search engines with result aggregation support.

Quick Start

# Default search (Tavily API - fastest)
python3 {baseDir}/scripts/web_search.py --query "your search query"

# Specify engine
python3 {baseDir}/scripts/web_search.py --query "你的搜索内容" --engine baidu
python3 {baseDir}/scripts/web_search.py --query "search terms" --engine google

# Aggregate from multiple engines
python3 {baseDir}/scripts/web_search.py --query "关键词" --engine all

# Limit results
python3 {baseDir}/scripts/web_search.py --query "..." --max-results 10

Search Engines

Engine	Method	Best For	Speed
tavily	API	General web search, fast results	⚡ Fastest
google	Browser	Comprehensive results, international	🐢 Slow
bing	Browser	Microsoft ecosystem, image search	🐢 Slow
baidu	Browser	Chinese content, domestic sites	🐢 Slow
duckduckgo	Browser	Privacy-focused, no tracking	🐢 Slow
all	Aggregated	Maximum coverage, research	🐌 Slowest

Commands

Tavily Search (Recommended)

Fast API-based search, best for most use cases:

python3 {baseDir}/scripts/web_search.py --query "..." --engine tavily

# With answer summary
python3 {baseDir}/scripts/web_search.py --query "..." --engine tavily --include-answer

# Markdown output
python3 {baseDir}/scripts/web_search.py --query "..." --engine tavily --format md

Requirements: TAVILY_API_KEY in environment or ~/.openclaw/.env

Browser-Based Search

Use agent-browser to access search engines directly:

# Google search
python3 {baseDir}/scripts/web_search.py --query "..." --engine google

# Baidu (for Chinese content)
python3 {baseDir}/scripts/web_search.py --query "关键词" --engine baidu

# Bing
python3 {baseDir}/scripts/web_search.py --query "..." --engine bing

# DuckDuckGo (privacy-focused)
python3 {baseDir}/scripts/web_search.py --query "..." --engine duckduckgo

Aggregated Search

Search multiple engines and combine results:

python3 {baseDir}/scripts/web_search.py --query "..." --engine all --max-results 5

This searches Tavily + Google + Baidu and deduplicates results.

Output Format

JSON (default)

{
  "query": "search query",
  "engine": "tavily",
  "results": [
    {
      "title": "Result Title",
      "url": "https://example.com",
      "snippet": "Brief description..."
    }
  ]
}

Markdown (--format md)

## Search Results: "query"

1. **[Title](url)**
   Description...

2. **[Title](url)**
   Description...

Decision Guide

Use Tavily when:

• Need quick results
• General web search
• API available

Use Google when:

• Need comprehensive results
• International content
• Tavily unavailable

Use Baidu when:

• Searching Chinese content
• Looking for domestic Chinese sites
• Researching Chinese topics

Use DuckDuckGo when:

• Privacy is important
• Avoiding tracking
• Alternative perspective

Use Aggregated when:

• Research needs comprehensive coverage
• Important topic requiring multiple sources
• Comparing results across engines

Workflow

1. Determine engine preference

   • Default: Tavily (fastest)
   • Chinese content: Baidu
   • Research: all engines

2. Run search

   python3 {baseDir}/scripts/web_search.py --query "..." --engine tavily --max-results 5
   

3. If more depth needed

   • Increase --max-results
   • Switch to --engine all
   • Use agent-browser directly for interactive search

Integration with agent-browser

For complex search tasks requiring interaction:

# Open Google
agent-browser open "https://www.google.com/search?q=query"

# Open Baidu
agent-browser open "https://www.baidu.com/s?wd=关键词"

# Extract results
agent-browser snapshot -i

See Agent Browser skill for full browser automation capabilities.

Notes

• Keep --max-results small (3-5) by default to reduce token usage
• Browser-based searches are slower due to page loading
• Aggregated search combines and deduplicates results from multiple engines
• For Chinese queries, Baidu often returns better localized results