Search Cluster

Aggregated search aggregator using Google CSE, GNews RSS, Wikipedia, Reddit, and Scrapling.

This skill appears to do what it claims: aggregate searches across Google CSE, Wikipedia, Reddit, Google News RSS, and a scrapling-based DuckDuckGo scraper. Before installing, consider the following: (1) Run the scrapling provider in a dedicated, isolated virtual environment as instructed and set SCRAPLING_PYTHON_PATH to that venv's python to avoid executing unreviewed code with your system python. (2) The SKILL.md references a scripts/ path while the files are at the repository root — verify the file paths when invoking the tool. (3) The scrapling package executes scraping logic (stealth_fetch.py runs as a subprocess); review that package's source or use network isolation if you don't trust it. (4) Google API keys (if used) and any Redis host you configure should be scoped and protected; REDIS_HOST is optional and only used for caching. (5) If you need higher assurance, inspect the referenced GitHub homepage (skill.json points to a repo) and/or run the code in a sandbox before granting access to any credentials or production networks.

Type: OpenClaw Skill Name: search-cluster Version: 3.5.1 The skill is classified as suspicious due to a potential Remote Code Execution (RCE) vulnerability in `search-cluster.py`. The `subprocess.run` call for the `scrapling_search` function uses the `SCRAPLING_PYTHON_PATH` environment variable as the executable path. If an attacker can control this environment variable, they could point it to an arbitrary executable, leading to RCE. While the skill's stated purpose is benign and it includes a prompt injection sanitizer (`internal_sanitize`), this configurable executable path represents a significant security risk, even without clear evidence of intentional malicious exploitation within the skill's own code.