openclaw-serper
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs legitimate network requests to the Serper API (
google.serper.dev) to fetch search results and utilizes thetrafilaturalibrary to download and extract content from external web pages. This behavior is consistent with the skill's primary purpose of web research. - [COMMAND_EXECUTION]: The skill operates via a Python script (
scripts/search.py) intended to be called by the agent to perform searches. - [DATA_EXFILTRATION]: Network activity is restricted to the documented API endpoints and target URLs for scraping; no evidence of sensitive data exfiltration or unauthorized communication with third-party servers was found.
- [CREDENTIALS_UNSAFE]: The skill correctly manages API keys by prompting the user to provide them via environment variables or a local
.envfile, with no hardcoded secrets present in the source code.
Audit Metadata