Goplaces

Query Google Places API (New) via the goplaces CLI for text search, place details, resolve, and reviews. Use for human-friendly place lookup or JSON output for scripts.

Security Scan

The skill's runtime instructions (SKILL.md) reasonably describe a Google Places CLI that needs a Homebrew install and a GOOGLE_PLACES_API_KEY, but the registry metadata claims no required binaries or env vars—this inconsistency and the third-party Homebrew tap recommendation merit caution.

Purpose & Capability

The SKILL.md describes a goplaces CLI that queries the Google Places API and requires the goplaces binary and a GOOGLE_PLACES_API_KEY—these are appropriate for the stated purpose. However, the registry-level 'Requirements' section lists no required binaries or env vars, which is inconsistent with the SKILL.md and suggests incomplete or incorrect metadata.

Instruction Scope

The instructions are narrowly scoped to installing and using the goplaces CLI and to setting GOOGLE_PLACES_API_KEY (and an optional base URL). They do not instruct the agent to read unrelated files, collect broad system context, or exfiltrate data to unexpected endpoints.

Install Mechanism

There is no install spec in the registry, but SKILL.md recommends installing steipete/tap/goplaces via Homebrew. Installing from a third-party Homebrew tap/PPA is common but carries more trust risk than official Homebrew/core packages — verify the tap/formula and repository before installing.

Credentials

Requesting GOOGLE_PLACES_API_KEY is proportional to the skill's purpose. The concern is the metadata mismatch: the registry claims no required env vars while SKILL.md requires one. This mismatch could lead to the agent not prompting for a necessary key or to misconfigured permissions. Also verify the API key is scoped and restricted (referrers/quota) before use.

Persistence & Privilege

The skill does not request permanent presence (always:false) and has no code/install that writes to disk via the registry. Autonomous model invocation is enabled (default) but that is expected and not a standalone concern here.

What to consider before installing

Before installing or enabling this skill: 1) Note the inconsistency — the registry metadata lists no required binaries/env vars but SKILL.md requires the goplaces binary and GOOGLE_PLACES_API_KEY. Don't assume the agent will auto-provide the key. 2) Verify the Homebrew tap and the GitHub repo (https://github.com/steipete/goplaces) and inspect the formula before running brew install from steipete/tap; third-party taps can execute arbitrary install steps. 3) Create a Google API key limited to the Places API, set appropriate referrer/IP restrictions and quota limits, and avoid using a broadly-permissioned key. 4) If you prefer lower risk, install goplaces manually on a test system first and confirm behavior, or use an alternative integration that uses official packages. 5) If you enable the skill for autonomous use, be aware the agent could call the CLI when invoked — ensure the environment variable and binary are only present in contexts you trust.

Modern Google Places API (New) CLI. Human output by default, --json for scripts.

Install

• Homebrew: brew install steipete/tap/goplaces

Config

• GOOGLE_PLACES_API_KEY required.
• Optional: GOOGLE_PLACES_BASE_URL for testing/proxying.

Common commands

• Search: goplaces search "coffee" --open-now --min-rating 4 --limit 5
• Bias: goplaces search "pizza" --lat 40.8 --lng -73.9 --radius-m 3000
• Pagination: goplaces search "pizza" --page-token "NEXT_PAGE_TOKEN"
• Resolve: goplaces resolve "Soho, London" --limit 5
• Details: goplaces details <place_id> --reviews
• JSON: goplaces search "sushi" --json

Notes

• --no-color or NO_COLOR disables ANSI color.
• Price levels: 0..4 (free → very expensive).
• Type filter sends only the first --type value (API accepts one).