图片检索技能（KuMa定制版）
v1.0.0Visual image search using Google Lens via SerpAPI. Identify objects, landmarks, products, plants, animals, artwork, logos, or any visual entity from an image...
⭐ 0· 49·0 current·0 all-time
byVenwell Chiang@kumamon2019s
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: the script calls SerpAPI Google Lens and requires a SERPAPI_KEY. The included script, README, and SKILL.md all describe the same image-search functionality; no unrelated cloud credentials or binaries are requested.
Instruction Scope
Runtime instructions are focused on performing Google Lens searches. However, local files are automatically uploaded to external image hosts (freeimage.host by default, imgbb as a fallback) — this is documented, but it means local image data will be sent to third parties. The SKILL.md/README mention IMGBB_API_KEY usage, but IMGBB_API_KEY is not listed in the skill's declared required env vars.
Install Mechanism
No install spec, no downloads or package installs. The skill is instruction-only with a bundled script using only Python stdlib, so it does not write arbitrary install-time code to disk beyond the included files.
Credentials
The declared required env var is SERPAPI_KEY which is appropriate. The script also reads IMGBB_API_KEY if set (not declared as required), and it contains a hard-coded public API key for freeimage.host. These additional env/use cases are plausible for uploading images but are not listed in requires.env, and embedding a key in code is a minor concern (though the key appears to be a public/freeimage host key).
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system settings, and does not require persistent elevated privileges. Agent-autonomous invocation is enabled by default but not excessive for this type of tool.
Assessment
This skill is functionally coherent for image reverse-search via SerpAPI, but note two practical privacy/security points before installing or using it: (1) any local image you submit will be uploaded to third-party image hosts (freeimage.host by default; imgbb if you provide IMGBB_API_KEY). Do not use this with sensitive images (IDs, passports, private photos, proprietary screenshots) unless you accept that they are sent to external hosts. (2) The script contains an embedded public key for freeimage.host and will also read IMGBB_API_KEY if present (IMGBB_API_KEY is not listed in the skill's declared env vars). If you want to reduce exposure, use image URLs instead of local files, run the script in an environment you control, or modify the script to use an image host you trust. Also verify which owner/publish metadata you trust (there is a minor ownerId mismatch between registry metadata and _meta.json) before granting broad access to your agent.Like a lobster shell, security has layers — review code before you run it.
latestvk97611zfknd0930efw3pxe4p3s83yghp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔍 Clawdis
EnvSERPAPI_KEY
Primary envSERPAPI_KEY