Prismfy Web Search | Free Google

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a disclosed Prismfy web-search integration; the main things to notice are that it uses a Prismfy API key, sends search queries to Prismfy, and registers a default search hook.

This skill is reasonable to install if you want Prismfy as OpenClaw's default web search. Use a dedicated API key, avoid searching for secrets or confidential text, and remember that automatic/default searches can use your quota and send query text to Prismfy.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If the API key is exposed or misused, someone could consume your Prismfy quota or access actions allowed by that key.

Why it was flagged

The helper authenticates to Prismfy using the user's API key. This is expected for the service, but it gives the skill delegated access to that Prismfy account and quota.

Skill content

-H "Authorization: Bearer $PRISMFY_API_KEY"

Recommendation

Use a dedicated, rotatable Prismfy key, store it only in trusted environment settings, and rotate it if it appears in logs or shared files.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Private names, internal project details, or secrets included in search queries would be sent to Prismfy.

Why it was flagged

Search terms and options are sent to Prismfy's external API. This is the core purpose of the skill, but query text can contain sensitive information if the user includes it.

Skill content

BASE_URL="https://api.prismfy.io" ... '{query: $q, engines: $engines, language: $lang, page: ($page | tonumber)}'

Recommendation

Avoid putting secrets, confidential documents, or sensitive personal data into search queries, and review Prismfy's privacy terms if that matters for your use case.

Low

#ASI10: Rogue Agents

What this means

Future agent sessions may prefer Prismfy for live information, which can send queries externally and consume quota.

Why it was flagged

The skill adds a persistent bootstrap instruction making Prismfy available as the default search tool. This is disclosed and consistent with the stated purpose.

Skill content

description: "Registers Prismfy as the default web search tool on every agent boot"

Recommendation

Install it only if you want Prismfy as the default search path; remove or disable the hook if you prefer manual-only search.