Google Maps Reviews Api Skill

PassAudited by ClawScan on May 1, 2026.

Overview

The skill transparently runs a BrowserAct workflow to retrieve Google Maps reviews; the main considerations are API key handling, external data sharing, and possible API quota/runtime use.

This skill appears coherent and purpose-aligned. Before installing, make sure you trust BrowserAct and the skill publisher enough to use a BrowserAct API key, avoid sending sensitive search queries, and monitor API quota or runtime for broad review-collection tasks.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using the skill must provide a BrowserAct credential that could be used to run BrowserAct workflows or consume account quota.

Why it was flagged

The script reads a BrowserAct API key from the environment and uses it as a bearer token for BrowserAct requests. This is expected for the stated API integration, with no evidence of unrelated credential use.

Skill content
api_key = os.getenv("BROWSERACT_API_KEY"); headers = {"Authorization": f"Bearer {api_key}"}
Recommendation

Prefer setting the API key as an environment variable, avoid pasting it into chat when possible, and rotate it if it is exposed.

What this means

Search terms and retrieved review data are handled by BrowserAct, so private research topics or sensitive business queries may leave the local environment.

Why it was flagged

The skill sends the user's search keywords, language, and country to the external BrowserAct workflow API. This data flow is disclosed and purpose-aligned.

Skill content
API_BASE_URL = "https://api.browseract.com/v2/workflow"; {"name": "KeyWords", "value": keywords}
Recommendation

Use the skill only for queries you are comfortable sending to BrowserAct, and review BrowserAct's data handling terms if the searches are sensitive.

What this means

A requested review extraction may start an external BrowserAct task and, on failure, a second attempt, which could take time or consume quota.

Why it was flagged

The agent is instructed to run a local Python command and may retry once on certain failures. This is central to the skill's purpose and bounded, but it can create additional external API usage.

Skill content
python -u ./scripts/google_maps_reviews_api.py "Keywords" "Language" "Country" ... automatically try to re-execute the script once
Recommendation

For large or costly review-collection jobs, confirm the intended query and monitor the run; stop it if the task appears unexpected or too long-running.

What this means

It may be harder to independently verify who maintains the skill or whether updates come from a trusted project.

Why it was flagged

The artifacts do not provide a source repository or homepage to verify provenance. The included code is straightforward, so this is a provenance note rather than a behavior concern.

Skill content
Source: unknown; Homepage: none
Recommendation

Review the included script before use and verify the BrowserAct endpoint and publisher trust before providing an API key.