Skylar Serper

• Risk level: Low
• Analyzed: Feb 18, 2026, 5:39 PM
• Findings: 0
• Version: 1.0.1

Overview

The skill is internally consistent: it implements a Serper.dev Google search wrapper, only requests the expected SERPER_API_KEY, and contains a small self-contained JS tool with no surprising install or credential demands.

This skill appears to do exactly what it claims: call Serper.dev's API and return search results. Before installing: (1) Verify you trust the skill source since the registry 'Source' and homepage are unknown; the code is small and readable but provenance matters. (2) Protect your SERPER_API_KEY — the tool sends it in the X-API-KEY header to google.serper.dev, so only provide a key with appropriate scope and limits. (3) Be aware the agent can invoke skills autonomously by default; while this skill doesn't request broad permissions, consider whether you want automatic queries to external APIs. (4) Minor metadata quirks (registry shows [object Object], package.json version mismatch) are likely packaging/UI issues — if you need higher assurance, run the included tools/serper_search.js locally and confirm behavior.