Multi-source search skill for Kiro on OpenClaw. Aggregate and rank results from Google, Google Scholar, YouTube, and X, then output a concise brief.
Security Analysis
medium confidenceThe skill's requirements and code align with its stated multi-source search purpose; it calls the declared search APIs and only requests the expected API keys.
Name/description ask for aggregated searches across Google, Scholar, YouTube, and X, and the package requires API keys and a python3 runtime which are appropriate and expected. The included script implements calls to Serper (google + videos), SerpAPI (google_scholar), and X recent search endpoints, matching the stated providers.
SKILL.md instructs running the included Python script with query/sources arguments. The script only reads the declared environment variables (SERPER_API_KEY, SERPAPI_API_KEY, X_BEARER_TOKEN), performs HTTP requests to the declared provider endpoints, and renders results to an outputs folder. There are no instructions to read unrelated system files or to transmit data to unexpected external endpoints.
No install spec is present (instruction-only skill with an included script). No external download/install steps are attempted. Requiring only python3 is proportionate.
The skill requires three API credentials that directly map to its four data sources. The primaryEnv (SERPER_API_KEY) is consistent with Serper usage for google and youtube. No unrelated secrets or broad system credentials are requested.
always is false and the skill does not request elevated or persistent platform privileges. It writes output to a local outputs/search-aggregator/ folder (expected for this functionality) and does not modify other skills or system-wide configs.
Guidance
This skill appears to do what it claims: it runs a Python script that queries Serper, SerpAPI, and X using the API keys you provide and saves aggregated results locally. Before installing, confirm you trust the skill producer and understand that: (1) the API keys you supply allow the script to query those services (provide least-privilege/read-only tokens where possible); (2) results and snippets will be written to outputs/search-aggregator/, so avoid putting secrets into queries; and (3) we reviewed most of the script and saw only expected HTTP calls, but part of the main function was truncated in the provided snippet — if you want higher confidence, inspect the complete scripts/search_aggregator.py file to verify there are no additional outbound endpoints or surprising filesystem/network actions.
Latest Release
v1.0.0
- Initial release of kiro-search-aggregator. - Aggregates and ranks search results from Google, Google Scholar, YouTube, and X. - Outputs both a machine-readable JSON and a concise Markdown summary with top results. - Supports multiple API keys for flexible integration with different search providers.
More by @Vmining
Published by @Vmining on ClawHub
