Google Search Skill

Performs Google searches with rich results including news, images, videos, places, shopping, scholar papers, patents, and search suggestions via Serper.dev API.

This skill appears to do what it says (use Serper.dev to return Google-like results), but the registry metadata omits the required SERPER_API_KEY that the code enforces. Before installing: 1) Confirm you have a Serper.dev API key and are willing to provide it to the agent (export SERPER_API_KEY). 2) Understand that the skill (and the agent via web_fetch) can fetch arbitrary external links returned in results — avoid giving it access to highly sensitive data or long-lived/privileged API keys. 3) Verify you trust the skill author/owner (no homepage provided) and consider creating a dedicated, limited Serper API key or monitoring/rotating the key if you proceed. 4) Note shopping queries consume extra credits; monitor your Serper account balance. The implementation contains no hidden endpoints, obfuscated code, or attempts to read unrelated local files, but the manifest inconsistency should be corrected before trusting automatic installs.

Type: OpenClaw Skill Name: serper-google-search Version: 1.0.0 The OpenClaw skill 'serper-google-search' is classified as benign. The code correctly handles user input by parsing arguments within the TypeScript script and then JSON-stringifying them before sending to the Serper.dev API, preventing command injection. The `SERPER_API_KEY` is securely retrieved from environment variables and used solely for authentication with the intended `https://google.serper.dev` endpoint. Neither the `SKILL.md` nor `README.md` contain any prompt injection attempts or instructions that would lead the AI agent to perform unauthorized actions, exfiltrate data, or establish persistence. All observed behaviors are aligned with the stated purpose of providing Google Search functionality.