WebSearch

Performs a web search using a local SearXNG instance and returns raw search results for the given query.

This skill is coherent with its description, but it relies on the presence and behavior of /usr/local/bin/websearch and on a reachable SearXNG instance. Before installing/using it: 1) verify the binary's provenance (owner, checksum, and source) and inspect it if possible; 2) run the binary manually with test queries to confirm expected behavior; 3) ensure the SearXNG instance is the one you control (queries may be logged or forwarded); 4) confirm the OpenClaw sandbox and host network policies limit what that binary can do (to reduce exfiltration risk); and 5) consider wrapping or replacing the binary with a small vetted script that enforces input validation and restricts network/file access if you need stronger guarantees.

Type: OpenClaw Skill Name: websearch Version: 1.0.0 The skill is classified as suspicious due to a potential shell injection vulnerability in `skill.yaml`. The user-provided `query` input is directly interpolated into the `args` array for the `/usr/local/bin/websearch` command without apparent sanitization or escaping. This could allow an attacker to inject arbitrary shell commands if the `websearch` executable or the underlying execution environment processes the argument string as a shell command, leading to Remote Code Execution (RCE).