openclaw-serper

Searches Google and extracts full page content from every result via trafilatura. Returns clean readable text, not just snippets. Use when the user needs web search, research, current events, news, factual lookups, product comparisons, technical documentation, or any question requiring up-to-date information from the internet.

This skill appears to do what it says (search via Serper and extract page text with trafilatura), but I found some inconsistencies you should address before installing: - Environment variable mismatch: The script requires SERPER_API_KEY (or SERP_API_KEY) but the published metadata claims no required env vars. Confirm you will supply a valid Serper API key and that you are comfortable storing it where the runtime will read it. - .env location ambiguity: README suggests ~/.openclaw/.env, but the script auto-loads only .env in the skill directory. Decide where you want the key stored (system-wide vs skill-local) and update the files accordingly. - Network behavior: The script will fetch arbitrary result URLs (concurrent, 3s timeout) and extract their full HTML text. This is necessary for the stated purpose, but be aware it means the agent runtime will make outbound requests to third-party sites and temporarily download page content. - Operational considerations: Ensure the runtime environment has trafilatura installed for the Python interpreter that will run the script, and that outbound network access to google.serper.dev and result sites is acceptable. Review Serper's rate limits and the safety of placing an API key where it will be read by the agent runtime. If you want to proceed, ask the skill owner to (1) update the published metadata to declare the required SERPER_API_KEY, and (2) clarify .env handling so you can safely provision the key. If those are corrected, the skill looks coherent and usable.

Type: OpenClaw Skill Name: openclaw-serper Version: 3.1.1 The OpenClaw Serper skill is benign. It performs web searches via the Serper API and extracts full page content using `trafilatura`, as described. The `SKILL.md` provides clear, non-malicious instructions for the agent on how to use the skill effectively, without attempting prompt injection for harmful objectives. The `scripts/search.py` correctly loads its own `SERPER_API_KEY` from a local `.env` file or environment variables, and makes network requests only to `google.serper.dev` and the URLs returned by the search, which is consistent with its stated purpose. No evidence of data exfiltration, malicious execution, persistence, or obfuscation was found.