serper
v3.0.2Google search via Serper API with full page content extraction. Fast API lookup + concurrent page scraping (3s timeout). One well-crafted query returns rich results — avoid multiple calls. Two modes, explicit locale control. API key via .env.
⭐ 7· 4.1k·20 current·21 all-time
by@nesdeq
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is indeed a Serper-backed web search that concurrently scrapes result pages with trafilatura — this aligns with the name/description/README/SKILL.md and the provided script. However, the registry metadata claims no required environment variables or primary credential while both README and the script require a SERPER_API_KEY (or SERP_API_KEY). That discrepancy is inconsistent and should be corrected/clarified.
Instruction Scope
SKILL.md instructs the agent to call Serper, fetch result URLs, and extract page content; the script implements this behavior. The instructions explicitly warn not to re-fetch returned URLs with other tools. The runtime behavior stays within the stated purpose (network calls to Serper and to result pages, local trafilatura extraction, streaming JSON output).
Install Mechanism
This is an instruction-only skill (no install spec). The README asks users to pip install trafilatura (standard package) and optionally clone the repo. No arbitrary remote downloads or archive extraction are present in the package files — low install risk.
Credentials
The script requires an API key (SERPER_API_KEY or SERP_API_KEY) but the registry metadata lists no required env vars/primary credential. The README suggests writing the key to ~/.openclaw/.env or the skill .env; the script auto-loads only the skill's .env. This mismatch could confuse users and lead to accidental exposure of the key or failed runs. Also, the skill fetches and prints full page content (possible sensitive data) for every result — this is expected for the purpose but increases data-exposure risk and should be considered when running in shared environments.
Persistence & Privilege
The skill does not request permanent inclusion (always:false) and does not modify other skill/system configs. It auto-loads a local .env from its skill directory (normal). No elevated privileges or persistent system changes are requested.
What to consider before installing
Key points before installing/using this skill:
- The script requires a Serper API key (SERPER_API_KEY or SERP_API_KEY). The registry metadata incorrectly lists no required env vars — don't trust the registry entry alone; set the key intentionally and securely.
- The code auto-loads a .env file located at the skill directory (../.env relative to scripts/search.py). The README also suggests ~/.openclaw/.env, but the provided loader does not read that path — verify where you place your key so it is not accidentally added to a global file or exposed. Prefer a user-scoped or secrets-managed location.
- The skill fetches full page bodies from arbitrary result URLs and prints them to stdout as JSON. That behavior is expected for full-content search, but it can leak sensitive content (paywalled/exposed data, PII) into agent logs or downstream processes. Only run this skill in environments where that output is acceptable.
- Rate limits and API usage: Serper has quotas; ensure you use a key with appropriate limits and avoid repeated searches — the SKILL.md enforces a 1–2 searches discipline for that reason.
- If you need stronger assurance: review the full scripts/search.py file yourself and consider running it in a sandboxed environment first. Confirm the origin of this skill (the registry lists an owner and README points to a GitHub repo); prefer skills with verifiable sources.
If you want to proceed, correct the registry metadata to declare the required API key so the platform can surface credential requirements to users, and consider restricting where full-page outputs are stored or sent.Like a lobster shell, security has layers — review code before you run it.
latestvk97f8rcrvz6jcr59kc63k7xq1h808hp4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
