← Back to Skills Marketplace
110
Downloads
0
Stars
0
Active Installs
5
Versions
Install in OpenClaw
/install power-search
Description
Self-hosted research tool combining Brave Search API + Browserless content fetching. Search the web with optional full-page content extraction and HTML parsing.
Usage Guidance
This skill appears to implement the advertised Brave Search + Browserless fetcher, but check a few things before installing:
- Expect to set BRAVE_API_KEY in your environment; the registry metadata omitted this. Do not proceed without providing the key deliberately.
- Prefer running Browserless locally (as the docs recommend). If you set BROWSERLESS_HOST to a remote service, that remote host will receive the HTML content of pages the skill fetches — treat that as sensitive.
- The package includes a placeholder git clone URL and no homepage/source; verify the canonical source (repository URL) and authenticity before trusting the package.
- Review the included scripts (brave-search.js, browserless.js, telegram-handler.js) yourself to confirm they match your expectations; the code is plain JS and relatively small to audit.
- If you plan to expose this as a Telegram-commandable skill to others, be aware it will fetch arbitrary URLs discovered from search results — consider rate-limiting, content sanitization, and restricting which sites can be fetched to reduce misuse or accidental access to internal resources.
Given the mismatches and the ability to fetch arbitrary pages, treat this as suspicious until you confirm the source and configure Browserless/keys securely.
Capability Analysis
Type: OpenClaw Skill
Name: power-search
Version: 2.1.2
The power-search skill is a legitimate web research tool that integrates the Brave Search API with a Browserless instance for content extraction. The codebase is transparent, well-documented, and follows security best practices by utilizing environment variables for sensitive API keys. Analysis of the JavaScript files (scripts/brave-search.js, scripts/browserless.js, etc.) reveals no evidence of data exfiltration, malicious execution, or hidden prompt injection; the tool's behavior is strictly aligned with its stated purpose of searching and parsing web content.
Capability Assessment
Purpose & Capability
The code, SKILL.md, and package manifest implement a CLI + Telegram handler that calls Brave Search and a Browserless instance — this matches the description. However the registry metadata claims no required env vars/binaries while SKILL.md and the runtime code require Docker, Node, npm and a BRAVE_API_KEY. That mismatch (required secret/runtime dependency omitted from registry) is an incoherence that could mislead users about what credentials/install steps are needed.
Instruction Scope
SKILL.md describes installing Docker/Browserless, setting BRAVE_API_KEY, and using the 'search' CLI or Telegram integration — and the code follows those instructions. The handler and runners fetch external URLs and POST to the configured Browserless host. The instructions assume a local Browserless, but nothing in the code prevents BROWSERLESS_HOST being set to a remote host, which would redirect fetches to an external endpoint. Also SKILL.md references a placeholder GitHub clone URL ('yourusername'), while the skill's Source/Homepage are unknown — that's an inconsistency in distribution instructions.
Install Mechanism
The skill is listed as instruction-only (no install spec) but the bundle includes code files and a package.json (with a 'search' binary). Installation guidance relies on clawhub or git+npm install and running Docker for Browserless. There is no remote binary download or obfuscated installer — lower install risk — but the missing canonical source/homepage and placeholder git URL reduce transparency.
Credentials
The runtime code requires a sensitive environment variable BRAVE_API_KEY (and optionally BROWSERLESS_HOST/PORT). The skill registry metadata did not declare any required env vars, creating an omission. The Telegram integration does not request Telegram credentials (which is fine if the platform routes messages), but the BRAVE_API_KEY is essential and sensitive and should have been declared. Additionally, because Browserless will fetch arbitrary URLs, if BROWSERLESS_HOST is set to a remote/attacker-controlled host it could be used to relay or exfiltrate fetched content — the documentation suggests local Browserless but the code allows any host.
Persistence & Privilege
The skill does not request 'always: true' or other elevated platform privileges. It is user-invocable and can be invoked autonomously by the agent (default), which is normal. The code does not attempt to modify other skills or system-wide agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install power-search - After installation, invoke the skill by name or use
/power-search - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.1.2
Add SECURITY.md addressing VirusTotal false positives and transparency documentation
v2.1.1
Add .env.example and .gitignore to prevent accidental credential commits
v2.1.0
Security fix: removed hardcoded API key. Requires BRAVE_API_KEY environment variable.
v2.0.1
Remove hardcoded API keys - require environment variables for security
v2.0.0
Self-hosted Brave Search + Browserless integration with Telegram support
Metadata
Frequently Asked Questions
What is Power Search?
Self-hosted research tool combining Brave Search API + Browserless content fetching. Search the web with optional full-page content extraction and HTML parsing. It is an AI Agent Skill for Claude Code / OpenClaw, with 110 downloads so far.
How do I install Power Search?
Run "/install power-search" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Power Search free?
Yes, Power Search is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Power Search support?
Power Search is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Power Search?
It is built and maintained by Church (@churchtg7); the current version is v2.1.2.
More Skills