Web Search Instant 1.1.0
v1.0.0Web search using DuckDuckGo Instant Answer API (no API key required). Use when you need to search the web for information, definitions, calculations, convers...
⭐ 0· 264·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description state a DuckDuckGo Instant Answer client and the package contains a shell CLI (web-search.sh) that queries api.duckduckgo.com. Required tools (curl/wget, optional jq, fallback to python3) are appropriate for the task. No unrelated credentials, services, or binaries are requested.
Instruction Scope
SKILL.md and web-search.sh instruct only running the CLI to perform searches. The README and tests accurately describe expected behavior. Minor scope notes: examples include a hard-coded example path (cd /home/hxx/clawd/tools && ./web-search.sh) which is environment-specific and unnecessary; test scripts may run queries and write temporary files (/tmp) if executed. The tool performs network requests to DuckDuckGo (expected).
Install Mechanism
No install spec — instruction-only with included shell scripts. Nothing is downloaded from external arbitrary URLs or extracted. Risk is low because no installation step writes remote code to disk beyond the existing bundled scripts.
Credentials
The skill requests no environment variables or credentials. It only needs network access and common CLI tools (curl/wget, optionally jq or python3). This is proportionate to a CLI web-search client. Note: user queries are sent to DuckDuckGo — do not submit sensitive secrets as search queries.
Persistence & Privilege
always is false, the skill is user-invocable and does not request persistent system privileges or modify other skills/config. There is no autonomous onboarding or forced inclusion.
Assessment
This skill appears internally consistent and implements a DuckDuckGo Instant Answer CLI. Before installing or running it: 1) Verify the publisher/source since registry metadata shows minor inconsistencies (registry listed version 1.0.0 while package files report 1.1.0 and _meta.json ownerId differs); confirm you trust the owner. 2) Inspect the included web-search.sh yourself (you already have it) — it makes outbound HTTPS requests to api.duckduckgo.com and uses curl/wget/jq/python3; it does not read secrets or require credentials. 3) Don’t run the test scripts or CLI with sensitive queries (queries are transmitted to DuckDuckGo and test suites will execute multiple queries and write temporary files). 4) If you plan to run on a restricted host, note the script’s fallbacks use jq or python3 and grep -P; some environments may lack these and behavior will differ. 5) If you need provenance, ask the publisher for a homepage, license, or signed release — the package currently lacks an authoritative homepage link. Overall the package looks coherent for its stated purpose, but validate source/trust before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97ejq3esba28jbxp1h7xgqmns8272m0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.