Shopping Expert

Find and compare products online (Google Shopping) and locally (stores near you). Auto-selects best products based on price, ratings, availability, and preferences. Generates shopping list with buy links and store locations. Use when asked to shop for products, find best deals, compare prices, or locate items locally. Supports budget constraints (low/medium/high or "$X"), preference filtering (brand, features, color), and dual-mode search (online + local stores).

This skill appears to do what it says (uses SerpAPI for online results and Google Places for local stores), but review these points before installing or providing API keys: - The registry requires both SERPAPI_API_KEY and GOOGLE_PLACES_API_KEY. If you only need online shopping, you should not have to provide a Google Places key — ask the publisher why both are mandatory or avoid providing the Places key. - The code is a Python script that declares dependencies (requests, urllib3) but the install spec only installs 'uv' via brew. Ensure you run it in an environment with Python 3.10+ and the required Python packages, or the script will fail. - The skill makes external network calls to SerpAPI and Google Places using your API keys. Only supply keys you trust and be aware of possible charges and quota usage from those services. - If you have security concerns, run the script in an isolated environment (container/VM) and inspect or run it with limited API keys (read-only or quota-limited) first. If you want to proceed, ask the publisher to clarify why GOOGLE_PLACES_API_KEY is listed as required in the registry (when SKILL.md states it's only needed for local/hybrid) and to provide an install step for the Python dependencies or a packaged runtime.

Type: OpenClaw Skill Name: shopping-expert Version: 1.1.0 The OpenClaw AgentSkills skill bundle 'shopping-expert' is classified as benign. The `SKILL.md` documentation clearly outlines the skill's purpose and required API keys (`SERPAPI_API_KEY`, `GOOGLE_PLACES_API_KEY`), which are directly relevant to its functionality. The `scripts/shop.py` Python code uses standard libraries (`requests`, `urllib3`) to interact with the legitimate SerpAPI and Google Places API endpoints. There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent. All observed behaviors are aligned with the stated purpose of finding and comparing products online and locally.