spots

Exhaustive Google Places search using grid-based scanning. Finds ALL places, not just what Google surfaces.

This skill appears to be a wrapper around a third‑party CLI that performs grid-based queries of Google Places and therefore needs a Google Places + Geocoding API key. Before installing or running it: 1) Confirm the repository (https://github.com/foeken/spots) and review its code for any unexpected behavior (network calls, file access, telemetry). 2) Don't put your production-wide Google API key into a shared agent environment — create a key with minimal permissions and monitor usage/billing. 3) The registry metadata should have declared GOOGLE_PLACES_API_KEY; treat that omission as a red flag and avoid allowing the agent to auto-read environment secrets until the skill metadata is corrected. 4) If you use 1Password, verify how secrets are retrieved (do not give broad CLI/agent access to your vault without auditing). 5) If you want lower risk, run the CLI locally yourself (in an isolated environment) rather than giving the agent the ability to invoke the external binary automatically. If the registry is updated to explicitly declare the API key requirement and to provide an audited install or embed the vetted client code, confidence would increase.

Type: OpenClaw Skill Name: spots Version: 0.2.0 The skill is classified as suspicious due to two high-risk capabilities outlined in `SKILL.md`. First, the `go install github.com/foeken/spots@latest` instruction involves downloading and executing code from a remote source, which introduces a supply chain risk. Second, the `op://Echo/Google API Key/credential` instruction directs the agent to interact with a credential manager (1Password) to retrieve a sensitive API key. While these actions are presented as necessary for the skill's stated purpose, they represent powerful capabilities that could be exploited under different circumstances, thus exceeding the threshold for a benign classification.