Google Maps Search Api Skill
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: google-maps-search-api-skill Version: 0.1.2 The skill is a legitimate integration for the BrowserAct API, designed to scrape business data from Google Maps. The Python script (google_maps_search_api.py) follows a standard workflow of initiating a task, polling for status, and retrieving results from api.browseract.com. No evidence of data exfiltration, credential theft, or malicious prompt injection was found; the instructions in SKILL.md are consistent with the script's functionality and include appropriate error handling and user guidance for API key setup.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A failed search may be run a second time automatically, potentially using more API quota or time.
The skill instructs the agent to run a local script with user-selected search parameters and to retry once on some failures. This is purpose-aligned and bounded, but it may consume additional time or BrowserAct usage.
python -u ./scripts/google_maps_search_api.py "search keywords" "language" "country" count ... automatically try to re-execute the script once
For broad or costly searches, confirm the keywords, country, and result count before running, and stop after the documented single retry if it fails.
If the key is exposed, someone could use the user's BrowserAct account or quota.
The script uses a BrowserAct API key from the environment as a bearer token. This is expected for the service, and there is no evidence it is logged or sent elsewhere, but it is still account authority.
api_key = os.getenv("BROWSERACT_API_KEY") ... headers = {"Authorization": f"Bearer {api_key}"}Prefer setting the key as an environment variable, avoid pasting it into shared chats or logs, and rotate or monitor the key if exposure is suspected.
The actual browser automation is performed by BrowserAct's hosted workflow, so provider behavior, availability, and account billing matter.
The core extraction work is delegated to a hardcoded BrowserAct-hosted workflow template rather than code fully contained in the artifact. This is disclosed and central to the skill, but users should trust the provider and template provenance.
TEMPLATE_ID = "77805072070738748" API_BASE_URL = "https://api.browseract.com/v2/workflow"
Verify the BrowserAct account, template, and pricing before use, especially for large searches.