Web Search Plus

Unified search skill with Intelligent Auto-Routing. Uses multi-signal analysis to automatically select between Serper (Google), Tavily (Research), Querit (Mu...

Security Scan

The skill's code, runtime instructions, and requested environment access are coherent with a multi-provider web-search aggregator; nothing requested is disproportionate to its stated purpose.

Purpose & Capability

Name/description (multi-provider web search + auto-routing) align with the included Python scripts and docs. Required binaries (python3, bash) match the implementation. The environment variables listed in SKILL.md (provider API keys, KILOCODE_API_KEY, SEARXNG_INSTANCE_URL) directly correspond to the advertised providers and are justified.

Instruction Scope

SKILL.md instructs running scripts/setup.py and scripts/search.py and documents CLI flags; that matches the provided scripts. The runtime will read provider API keys from environment variables or a .env file and will cache results under .cache/ (or WSP_CACHE_DIR). Note: caching stores full query+results locally (including potential sensitive queries) and the code auto-loads a .env file found in the skill root — both expected for this tool but worth the operator's attention.

Install Mechanism

No install spec (instruction-only from OpenClaw perspective); code is bundled as plain Python scripts. No remote downloads or third‑party installers are invoked by the registry metadata. This is the lower-risk pattern for a script-based skill.

Credentials

The only environment variables referenced are provider API keys and an optional SEARXNG_INSTANCE_URL/WSP_CACHE_DIR — these map directly to the advertised providers and caching configuration. The SKILL.md marks keys optional and says only one provider key is needed; that is consistent with the code's fallback/skip behavior for unconfigured providers.

Persistence & Privilege

The skill is not forced-always, does not request elevated system privileges, and only writes to its own cache and provider_health files inside the skill directory (or to a user-specified WSP_CACHE_DIR). That is normal for a CLI-based aggregator and consistent with its purpose.

Assessment

This skill appears to do what it claims, but review a few practical points before installing: - Cache: Search queries and provider results are stored in .cache/ by default (or WSP_CACHE_DIR). If you handle sensitive queries, either disable caching per-run, change the cache directory to a controlled location, or clear/secure the cache regularly. - .env autoload: The script will auto-load a .env file from the skill root if present. Do not keep secrets in that file unless you intend the skill (or other local users) to access them. Prefer process-level environment variables or dedicated API accounts/limits. - SearXNG usage: The skill can call a self-hosted SearXNG instance. Only point SEARXNG_INSTANCE_URL to instances you control or trust; avoid public instances that may log queries. The changelog mentions previous SSRF issues that were fixed — if you are running an older fork, verify the version includes the SSRF protections. - Provider keys: Grant minimal-privilege / cost-limited provider API keys where possible. Using a single dedicated key/account for testing is safer than reusing high-privilege keys. - Updates & provenance: The registry entry has no homepage and an unknown source. If you plan to rely on this in production, prefer obtaining the code from an authoritative repository (or verify the publisher) and keep it updated. If you need stronger assurance, audit the full search.py and setup.py files locally for any network calls beyond advertised provider endpoints.

Stop choosing search providers. Let the skill do it for you.

This skill connects you to 7 search providers (Serper, Tavily, Querit, Exa, Perplexity, You.com, SearXNG) and automatically picks the best one for each query. Shopping question? → Google results. Research question? → Deep research engine. Need a direct answer? → AI-synthesized with citations. Want privacy? → Self-hosted option.

---

✨ What Makes This Different?

• Just search — No need to think about which provider to use
• Smart routing — Analyzes your query and picks the best provider automatically
• 7 providers, 1 interface — Google results, research engines, neural search, AI answers with citations, RAG-optimized, and privacy-first all in one
• Works with just 1 key — Start with any single provider, add more later
• Free options available — SearXNG is completely free (self-hosted)

---

🚀 Quick Start

# Interactive setup (recommended for first run)
python3 scripts/setup.py

# Or manual: copy config and add your keys
cp config.example.json config.json

The wizard explains each provider, collects API keys, and configures defaults.

---

🔑 API Keys

You only need ONE key to get started. Add more providers later for better coverage.

Provider	Free Tier	Best For	Sign Up
Serper	2,500/mo	Shopping, prices, local, news	serper.dev
Tavily	1,000/mo	Research, explanations, academic	tavily.com
Querit	Contact sales/free tier varies	Multilingual AI search, international updates	querit.ai
Exa	1,000/mo	"Similar to X", startups, papers	exa.ai
Perplexity	Via Kilo	Direct answers with citations	kilo.ai
You.com	Limited	Real-time info, AI/RAG context	api.you.com
SearXNG	FREE ✅	Privacy, multi-source, $0 cost	Self-hosted

Setting your keys:

# Option A: .env file (recommended)
export SERPER_API_KEY="your-key"
export TAVILY_API_KEY="your-key"
export QUERIT_API_KEY="your-key"

# Option B: config.json
{ "serper": { "api_key": "your-key" } }

---

🎯 When to Use Which Provider

I want to...	Provider	Example Query
Find product prices	Serper	"iPhone 16 Pro Max price"
Find restaurants/stores nearby	Serper	"best pizza near me"
Understand how something works	Tavily	"how does HTTPS encryption work"
Do deep research	Tavily	"climate change research 2024"
Search across languages / international updates	Querit	"latest AI policy updates in Germany"
Find companies like X	Exa	"startups similar to Notion"
Find research papers	Exa	"transformer architecture papers"
Get a direct answer with sources	Perplexity	"events in Berlin this weekend"
Know the current status of something	Perplexity	"what is the status of Ethereum upgrades"
Get real-time info	You.com	"latest AI regulation news"
Search without being tracked	SearXNG	anything, privately

Pro tip: Just search normally! Auto-routing handles most queries correctly. Override with -p provider when needed.

---

🧠 How Auto-Routing Works

The skill looks at your query and picks the best provider:

"iPhone 16 price"              → Serper (shopping keywords)
"how does quantum computing work" → Tavily (research question)
"latest AI policy updates in Germany" → Querit (multilingual + recency)
"companies like stripe.com"    → Exa (URL detected, similarity)
"events in Graz this weekend"  → Perplexity (local + direct answer)
"latest news on AI"            → You.com (real-time intent)
"search privately"             → SearXNG (privacy keywords)

What if it picks wrong? Override it: python3 scripts/search.py -p tavily -q "your query"

Debug routing: python3 scripts/search.py --explain-routing -q "your query"

---

📖 Usage Examples

Let Auto-Routing Choose (Recommended)

python3 scripts/search.py -q "Tesla Model 3 price"
python3 scripts/search.py -q "explain machine learning"
python3 scripts/search.py -q "latest AI policy updates in Germany"
python3 scripts/search.py -q "startups like Figma"

Force a Specific Provider

python3 scripts/search.py -p serper -q "weather Berlin"
python3 scripts/search.py -p tavily -q "quantum computing" --depth advanced
python3 scripts/search.py -p querit -q "latest AI policy updates in Germany"
python3 scripts/search.py -p exa --similar-url "https://stripe.com" --category company
python3 scripts/search.py -p you -q "breaking tech news" --include-news
python3 scripts/search.py -p searxng -q "linux distros" --engines "google,bing"

---

⚙ Configuration

{
  "auto_routing": {
    "enabled": true,
    "fallback_provider": "serper",
    "confidence_threshold": 0.3,
    "disabled_providers": []
  },
  "serper": {"country": "us", "language": "en"},
  "tavily": {"depth": "advanced"},
  "exa": {"type": "neural"},
  "you": {"country": "US", "include_news": true},
  "searxng": {"instance_url": "https://your-instance.example.com"}
}

---

📊 Provider Comparison

Feature	Serper	Tavily	Exa	Perplexity	You.com	SearXNG
Speed	⚡⚡⚡	⚡⚡	⚡⚡	⚡⚡	⚡⚡⚡	⚡⚡
Direct Answers	✗	✗	✗	✓✓	✗	✗
Citations	✗	✗	✗	✓	✗	✗
Factual Accuracy	⭐⭐⭐	⭐⭐⭐	⭐⭐	⭐⭐⭐	⭐⭐⭐	⭐⭐⭐
Semantic Understanding	⭐	⭐⭐	⭐⭐⭐	⭐⭐⭐	⭐⭐	⭐
Full Page Content	✗	✓	✓	✓	✓	✗
Shopping/Local	✓	✗	✗	✗	✗	✓
Find Similar Pages	✗	✗	✓	✗	✗	✗
RAG-Optimized	✗	✓	✗	✗	✓✓	✗
Privacy-First	✗	✗	✗	✗	✗	✓✓
API Cost	$$	$$	$$	Via Kilo	$	FREE

---

❓ Common Questions

Do I need API keys for all providers?

No. You only need keys for providers you want to use. Start with one (Serper recommended), add more later.

Which provider should I start with?

Serper — fastest, cheapest, largest free tier (2,500 queries/month), and handles most queries well.

What if I run out of free queries?

The skill automatically falls back to your other configured providers. Or switch to SearXNG (unlimited, self-hosted).

How much does this cost?

• Free tiers: 2,500 (Serper) + 1,000 (Tavily) + 1,000 (Exa) = 4,500+ free searches/month
• SearXNG: Completely free (just ~$5/mo if you self-host on a VPS)
• Paid plans: Start around $10-50/month depending on provider

Is SearXNG really private?

Yes, if self-hosted. You control the server, no tracking, no profiling. Public instances depend on the operator's policy.

How do I set up SearXNG?

# Docker (5 minutes)
docker run -d -p 8080:8080 searxng/searxng

Then enable JSON API in settings.yml. See docs.searxng.org.

Why did it route my query to the "wrong" provider?

Sometimes queries are ambiguous. Use --explain-routing to see why, then override with -p provider if needed.

---

🔄 Automatic Fallback

If one provider fails (rate limit, timeout, error), the skill automatically tries the next provider. You'll see routing.fallback_used: true in the response when this happens.

---

📤 Output Format

{
  "provider": "serper",
  "query": "iPhone 16 price",
  "results": [{"title": "...", "url": "...", "snippet": "...", "score": 0.95}],
  "routing": {
    "auto_routed": true,
    "provider": "serper",
    "confidence": 0.78,
    "confidence_level": "high"
  }
}

---

⚠ Important Note

Tavily, Serper, and Exa are NOT core OpenClaw providers.

❌ Don't modify ~/.openclaw/openclaw.json for these
✅ Use this skill's scripts — keys auto-load from .env

---

🔒 Security

SearXNG SSRF Protection: The SearXNG instance URL is validated with defense-in-depth:

• Enforces http/https schemes only
• Blocks cloud metadata endpoints (169.254.169.254, metadata.google.internal)
• Resolves hostnames and blocks private/internal IPs (loopback, RFC1918, link-local, reserved)
• Operators who intentionally self-host on private networks can set SEARXNG_ALLOW_PRIVATE=1

📚 More Documentation

• FAQ.md — Detailed answers to more questions
• TROUBLESHOOTING.md — Fix common errors
• README.md — Full technical reference

---

🔗 Quick Links

• Serper — Google Search API
• Tavily — AI Research Search
• Exa — Neural Search
• Perplexity — AI-Synthesized Answers (via Kilo Gateway)
• You.com — RAG/Real-time Search
• SearXNG — Privacy-First Meta-Search