SerpAPI

Unified search API across Google, Amazon, Yelp, OpenTable, Walmart, and more. Use when searching for products, local businesses, restaurants, shopping, images, news, or any web search. One API key, many engines.

This skill appears to do what it says: a CLI wrapper that calls SerpAPI and needs SERPAPI_API_KEY. Before installing, consider: 1) Use a dedicated SerpAPI key with minimal permissions and monitor/rotate it if possible; avoid reusing high-privilege keys. 2) Review the included script (scripts/serp.py) yourself — it is short and readable and only contacts serpapi.com/search.json. 3) Be aware the tool will try to read a TOOLS.md (home/clawd/TOOLS.md, cwd/TOOLS.md, or path via CLAWDBOT_WORKSPACE) to get a default location — if you keep sensitive data there, remove it or set an explicit --location when invoking. 4) The metadata omits declaring SERPAPI_API_KEY as the primary credential in the registry; treat that as a documentation gap rather than malicious behavior. 5) If you plan to let the agent invoke the skill autonomously, ensure the API key is scoped and rate-limited to reduce blast radius. Overall the skill is coherent, but always audit keys and workspace files before enabling.

Type: OpenClaw Skill Name: serpapi Version: 1.0.0 This skill is designed to interact with the legitimate SerpAPI service. It securely retrieves the `SERPAPI_API_KEY` from environment variables and optionally reads a default location from `TOOLS.md` within the workspace, which is a standard configuration pattern for agent skills. All network requests are directed to `https://serpapi.com`, and parameters are properly encoded using `urllib.parse.urlencode`, preventing injection vulnerabilities. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md` or `scripts/serp.py`.