Shopping Expert
v1.1.0Find and compare products online (Google Shopping) and locally (stores near you). Auto-selects best products based on price, ratings, availability, and preferences. Generates shopping list with buy links and store locations. Use when asked to shop for products, find best deals, compare prices, or locate items locally. Supports budget constraints (low/medium/high or "$X"), preference filtering (brand, features, color), and dual-mode search (online + local stores).
⭐ 5· 3.3k·15 current·16 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with functionality: the code calls SerpAPI for Google Shopping and Google Places for local searches. Requesting SERPAPI_API_KEY and GOOGLE_PLACES_API_KEY is expected for online and local modes respectively.
Instruction Scope
SKILL.md instructs the agent to run the provided Python script via 'uv run'. The runtime instructions and script only reference the two API keys and do not ask for unrelated files or secrets. The SKILL.md correctly documents that GOOGLE_PLACES_API_KEY is only required for local/hybrid modes, but the registry's required env list contradicts that (see environment_proportionality).
Install Mechanism
Install spec is a brew formula for 'uv' which matches the example 'uv run ...' usage. This is a low-risk install mechanism compared with arbitrary downloads. However, the script is Python and declares Python package dependencies (requests, urllib3) in its header, but the install spec does not install those Python dependencies or ensure Python is present—this mismatch may cause runtime failures.
Credentials
Registry requires both SERPAPI_API_KEY and GOOGLE_PLACES_API_KEY. SKILL.md and the code indicate SERPAPI is needed for online/hybrid and GOOGLE_PLACES only for local/hybrid. Requiring both keys unconditionally is disproportionate if a user only wants online-only searches. PrimaryEnv set to SERPAPI_API_KEY is appropriate, but forcing a Places key when not needed is an unnecessary credential request.
Persistence & Privilege
The skill does not request always:true and does not declare any system-wide configuration changes. It runs as an on-demand script and has normal autonomous-invocation defaults; no elevated persistence or cross-skill modification is present.
What to consider before installing
This skill appears to do what it says (uses SerpAPI for online results and Google Places for local stores), but review these points before installing or providing API keys:
- The registry requires both SERPAPI_API_KEY and GOOGLE_PLACES_API_KEY. If you only need online shopping, you should not have to provide a Google Places key — ask the publisher why both are mandatory or avoid providing the Places key.
- The code is a Python script that declares dependencies (requests, urllib3) but the install spec only installs 'uv' via brew. Ensure you run it in an environment with Python 3.10+ and the required Python packages, or the script will fail.
- The skill makes external network calls to SerpAPI and Google Places using your API keys. Only supply keys you trust and be aware of possible charges and quota usage from those services.
- If you have security concerns, run the script in an isolated environment (container/VM) and inspect or run it with limited API keys (read-only or quota-limited) first.
If you want to proceed, ask the publisher to clarify why GOOGLE_PLACES_API_KEY is listed as required in the registry (when SKILL.md states it's only needed for local/hybrid) and to provide an install step for the Python dependencies or a packaged runtime.Like a lobster shell, security has layers — review code before you run it.
latestvk9738ykchck0bv1q63ttbvskz97za1ce
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🛒 Clawdis
Binsuv
EnvSERPAPI_API_KEY, GOOGLE_PLACES_API_KEY
Primary envSERPAPI_API_KEY
Install
Install uv (brew)
Bins: uv
brew install uv