图片检索技能（KuMa定制版）

Visual image search using Google Lens via SerpAPI. Identify objects, landmarks, products, plants, animals, artwork, logos, or any visual entity from an image...

Security Scan

The skill appears to do what it says (reverse image search via SerpAPI Google Lens) and its requirements mostly match its behavior, but it will upload local images to third-party hosts and has small metadata/env inconsistencies you should be aware of.

Purpose & Capability

Name/description match the implementation: the script calls SerpAPI Google Lens and requires a SERPAPI_KEY. The included script, README, and SKILL.md all describe the same image-search functionality; no unrelated cloud credentials or binaries are requested.

Instruction Scope

Runtime instructions are focused on performing Google Lens searches. However, local files are automatically uploaded to external image hosts (freeimage.host by default, imgbb as a fallback) — this is documented, but it means local image data will be sent to third parties. The SKILL.md/README mention IMGBB_API_KEY usage, but IMGBB_API_KEY is not listed in the skill's declared required env vars.

Install Mechanism

No install spec, no downloads or package installs. The skill is instruction-only with a bundled script using only Python stdlib, so it does not write arbitrary install-time code to disk beyond the included files.

Credentials

The declared required env var is SERPAPI_KEY which is appropriate. The script also reads IMGBB_API_KEY if set (not declared as required), and it contains a hard-coded public API key for freeimage.host. These additional env/use cases are plausible for uploading images but are not listed in requires.env, and embedding a key in code is a minor concern (though the key appears to be a public/freeimage host key).

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system settings, and does not require persistent elevated privileges. Agent-autonomous invocation is enabled by default but not excessive for this type of tool.

Assessment

This skill is functionally coherent for image reverse-search via SerpAPI, but note two practical privacy/security points before installing or using it: (1) any local image you submit will be uploaded to third-party image hosts (freeimage.host by default; imgbb if you provide IMGBB_API_KEY). Do not use this with sensitive images (IDs, passports, private photos, proprietary screenshots) unless you accept that they are sent to external hosts. (2) The script contains an embedded public key for freeimage.host and will also read IMGBB_API_KEY if present (IMGBB_API_KEY is not listed in the skill's declared env vars). If you want to reduce exposure, use image URLs instead of local files, run the script in an environment you control, or modify the script to use an image host you trust. Also verify which owner/publish metadata you trust (there is a minor ownerId mismatch between registry metadata and _meta.json) before granting broad access to your agent.

Image Search (Google Lens)

Identify anything from an image using Google Lens via SerpAPI.

Setup

Requires SERPAPI_KEY environment variable. Get a key at https://serpapi.com/ (100 free searches/month).

No pip dependencies needed — uses only Python stdlib (urllib, json, base64).

Usage

From CLI / Agent (exec tool)

# Search by image URL
python3 {baseDir}/scripts/lens_search.py "https://example.com/photo.jpg"

# Search by local file (auto-uploads to get a URL)
python3 {baseDir}/scripts/lens_search.py /path/to/image.png

# Refine with text query (e.g., find red version of a product)
python3 {baseDir}/scripts/lens_search.py "https://example.com/bag.jpg" --query "red"

# Product search (returns prices)
python3 {baseDir}/scripts/lens_search.py "https://example.com/sneakers.jpg" --type products

# Find exact matches (where this image appears online)
python3 {baseDir}/scripts/lens_search.py "https://example.com/photo.jpg" --type exact_matches

# Raw JSON output for programmatic use
python3 {baseDir}/scripts/lens_search.py "https://example.com/photo.jpg" --json

# Localized results (e.g., Japanese products with ¥ prices)
python3 {baseDir}/scripts/lens_search.py "https://example.com/laptop.jpg" --type products --country jp

Search Types

Type	Use Case	Returns
all (default)	General identification	Entity name + visual matches + text
visual_matches	Find similar images	Visually similar results with sources
exact_matches	Find image origin	Pages containing this exact image
products	Shopping / price lookup	Products with prices and buy links
about_this_image	Image provenance	Metadata about the image's origin

Output Format

The script outputs structured markdown:

## Identified Entity
- **Danny DeVito** — [link](https://...)

## Visual Matches (top 5)
- **Danny DeVito — Wikipedia** (Wikipedia) ✅ exact match
  https://en.wikipedia.org/wiki/Danny_DeVito
- ...

Use --json for raw SerpAPI response when you need thumbnails, image dimensions, or other metadata.

Agent Decision Guide

When a user sends an image:

1. Already identified by vision model? If the main model confidently recognizes the entity, skip reverse search.
2. Uncertain identification? Run lens_search.py to verify. Compare model's guess with Lens results.
3. Need details beyond identification? First identify with Lens, then web_search for deeper info.
4. Shopping intent? Use --type products to get prices and buy links directly.
5. Local file from user? The script handles local files by auto-uploading to get a searchable URL.

Combining with Other Tools

Typical multi-tool workflow:

1. User sends image → "What building is this?"
2. reverse_image_search → identifies "Cologne Cathedral"
3. web_search("Cologne Cathedral history architecture") → detailed info
4. Compose answer combining visual match + web knowledge

Limitations

• SerpAPI free tier: 100 searches/month. Paid plans from $50/month.
• Local file upload uses freeimage.host (free) or imgbb (needs IMGBB_API_KEY).
• Google Lens results vary by region; use --country for localized results.
• Some niche/long-tail entities may not return useful visual matches.