Naver Search

Modularized Naver Search. Features separate scripts for Web, News, Shopping, and Images. Integrates SerpAPI specialized parameters.

This package implements the advertised Naver/SerpAPI searches, but there are two issues to consider before installing: - Metadata mismatch: the skill requires SERPAPI_API_KEY (and reads .env) but the registry did not declare this required credential. Confirm you are comfortable providing a SerpAPI key and that the publisher should have declared it. - Import path change: lib/naver_base.py injects the user's site-packages path at the start of sys.path. That can cause local/user-installed packages to be imported in place of system packages (a supply-chain/namespace shadowing risk). Consider reviewing the code locally, running in a sandbox, or removing the sys.path modification before use. - Operational safety: store the API key in a dedicated, least-privilege SerpAPI account, protect the .env file (chmod 600), and inspect or run the scripts in an isolated environment if you don't trust the publisher. Ask the publisher to update registry metadata to list SERPAPI_API_KEY and to explain why user_site is prepended to sys.path.

Type: OpenClaw Skill Name: naver-search Version: 1.0.4 The skill is designed to perform Naver searches via SerpAPI, which aligns with its stated purpose. It uses `SERPAPI_API_KEY` from environment variables or a `.env` file for its intended function. While storing API keys in a `.env` file can be a vulnerability if file permissions are not properly secured (as noted in `lib/naver_base.py`), the skill itself does not attempt to exfiltrate this key or any other sensitive data. The `scripts/naver_search.py` uses `subprocess.run` to execute other Python scripts within the same bundle, passing arguments as a list, which prevents shell injection from the query parameter. No evidence of prompt injection, obfuscation, or other malicious intent was found in any of the files, including `SKILL.md` and `README.md`.