Multi-source search skill for Kiro on OpenClaw. Aggregate and rank results from Google, Google Scholar, YouTube, and X, then output a concise brief.

This skill appears to do what it claims: it runs a Python script that queries Serper, SerpAPI, and X using the API keys you provide and saves aggregated results locally. Before installing, confirm you trust the skill producer and understand that: (1) the API keys you supply allow the script to query those services (provide least-privilege/read-only tokens where possible); (2) results and snippets will be written to outputs/search-aggregator/, so avoid putting secrets into queries; and (3) we reviewed most of the script and saw only expected HTTP calls, but part of the main function was truncated in the provided snippet — if you want higher confidence, inspect the complete scripts/search_aggregator.py file to verify there are no additional outbound endpoints or surprising filesystem/network actions.

Type: OpenClaw Skill Name: kiro-search-aggregator Version: 1.0.0 The skill is designed to aggregate search results from multiple sources using specified API keys. The `SKILL.md` clearly outlines its purpose and required environment variables. The `search_aggregator.py` script uses standard Python libraries (`urllib.request`, `argparse`, `os.getenv`) to fetch API keys and make requests to legitimate search API endpoints (Serper, SerpAPI, X). User input for the search query is passed as a string parameter to these APIs, without any evidence of local command injection or arbitrary code execution. There are no attempts to exfiltrate sensitive data beyond the stated purpose, establish persistence, or use obfuscation. While an AI agent platform could be vulnerable to prompt injection if it poorly handles user input when executing the example command in `SKILL.md`, the skill itself does not contain malicious instructions or code designed to exploit such vulnerabilities.