# web-search-plus

[github.com/openclaw/skills](https://github.com/openclaw/skills)

## Trust Assessment

web-search-plus received a trust score of 76/100, placing it in the **Mostly Trusted** category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 5 findings: 0 critical, 0 high, 3 medium, and 1 low severity. Key findings include Suspicious import: urllib.request, Node lockfile missing, Potential command injection via sourced .env file in test script.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

### Layer Breakdown

| Layer | Score |
| --- | --- |
| Manifest Analysis | 100% |
| Static Code Analysis | 79% |
| Dependency Graph | 98% |
| LLM Behavioral Safety | 100% |

## Behavioral Risk Signals

- **Network Access:** 3 findings
- **Filesystem Write:** 2 findings
- **Shell Execution:** 1 finding
- **Dynamic Code:** 1 finding
- **Excessive Permissions:** 3 findings

## Security Findings

| Severity | Finding | Layer | Location |
| --- | --- | --- | --- |
| MEDIUM | Suspicious import: urllib.request<br>Import of 'urllib.request' detected. This module provides network or low-level system access.<br>Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/robbyczgw-cla/web-search-plus/scripts/search.py:30 |
| MEDIUM | Suspicious import: urllib.request<br>Import of 'urllib.request' detected. This module provides network or low-level system access.<br>Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/robbyczgw-cla/web-search-plus/scripts/search.py:1296 |
| MEDIUM | Suspicious import: urllib.request<br>Import of 'urllib.request' detected. This module provides network or low-level system access.<br>Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/robbyczgw-cla/web-search-plus/scripts/setup.py:186 |
| LOW | Node lockfile missing<br>package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock).<br>Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/robbyczgw-cla/web-search-plus/package.json |
| INFO | Potential command injection via sourced .env file in test script<br>The `test-auto-routing.sh` script uses `source .env` to load environment variables. If an attacker can modify the `.env` file, they could inject arbitrary shell commands that would be executed when the script is run. While `.env` files are typically controlled by the user/developer and are part of the trusted environment, this pattern represents a potential command injection vector if the `.env` file's integrity is compromised. This is a test script, reducing the immediate operational risk.<br>Ensure the `.env` file is protected from unauthorized modification. For production environments or scripts handling untrusted input, consider parsing `.env` files with a dedicated library that does not execute arbitrary commands, rather than sourcing them directly. | LLM | test-auto-routing.sh:5 |

## Scan History

### Embed Code

MarkdownHTMLImage URL

```

```