Web Search Pro
PassAudited by ClawScan on May 10, 2026.
Overview
This appears to be a legitimate web search and crawling skill, but it sends queries/URLs to external providers, can use optional API keys, and keeps a local cache.
Install if you want an agent to perform live web search, extraction, and bounded crawling. Before using it, decide which external providers you trust, configure only the API keys you need, be aware that queries and URLs may be sent to those services, and clear the local cache if you search or retrieve sensitive material.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can make outbound web requests and may visit multiple pages when asked to crawl a site.
The skill can fetch and crawl user-provided websites, including an option to allow cross-origin discovery, but the command exposes limits such as depth and maximum pages.
crawl.mjs "url1" ["url2" ...] [options] ... --depth <n> ... --max-pages <n> ... --no-same-origin
Use explicit URLs, keep crawl limits small, and avoid enabling cross-origin crawling unless you intend wider discovery.
If you configure provider API keys, the skill can spend quota and send your search/extraction requests to those providers.
The engine reads a provider API key from the environment and sends it to the provider API, which is expected for authenticated search integration.
const apiKey = (process.env.EXA_API_KEY ?? "").trim(); ... "x-api-key": apiKey
Use provider keys with the minimum needed scope, monitor quota/billing, and only configure providers you trust.
Search results, crawled content, or query-related data may persist locally and be reused until the cache expires or is cleared.
The skill discloses persistent local state for cached search/crawl results, which may include prior queries or retrieved page content.
local state directory: `.cache/web-search-pro`
Avoid searching highly sensitive terms if local caching is a concern, and use the provided cache clear command when needed.