Local Places

Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.

Security Scan

The code and instructions mostly match a local Google Places proxy, but metadata/registry mismatches and an unusual dependency ('uv') plus undeclared environment usage make the package inconsistent and worth caution.

Purpose & Capability

The source files implement a FastAPI server that proxies Google Places calls and the SKILL.md describes exactly that flow (resolve location → search → details). That capability matches the skill name and description. Minor oddities: pyproject uses the generic name 'my-api' and the FastAPI default server URL includes a personal hostname ('maxims-macbook-air:8000'), which looks like leftover developer config but does not break functionality.

Instruction Scope

SKILL.md instructs running a local FastAPI server and then curling local endpoints; the runtime instructions and the code line up. The instructions require a GOOGLE_PLACES_API_KEY and expect a .env file; the code reads that env var. Nothing in SKILL.md or the code asks to read unrelated sensitive files. However the SKILL.md metadata instructs use of a binary named 'uv' (uv venv, uv pip, uv run) — these commands appear throughout the docs and give runtime control to an unusual helper binary rather than standard tooling, which is unexpected and should be verified before use.

Install Mechanism

There is no install spec (no network download/install step) and the package includes Python source with a normal pyproject listing FastAPI and httpx. That is lower risk than an arbitrary URL installer. Still, the repo expects users to run commands that use a nonstandard 'uv' wrapper; since no install spec provided, verify what 'uv' is on your system before running those commands.

Credentials

The code and SKILL.md use and declare a single environment variable GOOGLE_PLACES_API_KEY (and support overriding GOOGLE_PLACES_BASE_URL), which is appropriate for a Google Places proxy. However the registry metadata you provided shows no required envs or binaries, while SKILL.md metadata requires 'uv' and GOOGLE_PLACES_API_KEY and lists primaryEnv. This mismatch (registry vs SKILL.md vs code) is an incoherence. Also the ability to override GOOGLE_PLACES_BASE_URL means someone could point requests to a non-Google endpoint — if that happens, the server will send the API key in headers to whatever URL is set, so ensure BASE_URL is not changed to untrusted hosts.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system configuration, and has no unusual persistence claims. It only implements a local server; normal caution around running network servers applies.

What to consider before installing

Things to check before installing/running: 1. Confirm the environment variable requirement: SKILL.md and the code require GOOGLE_PLACES_API_KEY. The registry metadata you saw did not list this — treat the SKILL.md as authoritative and only provide an API key with minimal privileges/billing safeguards. 2. Investigate the 'uv' binary referenced in SKILL.md (commands like 'uv venv', 'uv pip', 'uv run'). 'uv' is not a standard Python tool; find out what it is on your machine (which uv / inspect its contents) or run the setup steps using standard tools (python -m venv, pip, uvicorn) instead. 3. Pay attention to GOOGLE_PLACES_BASE_URL: it is overridable via env and defaults to the real Google endpoint. Do not point it to arbitrary hosts because the server will forward your API key in headers to that host. 4. Run the server in an isolated environment (local VM or container) and review the included source files yourself if possible — they are small and readable. Watch for any unexpected network traffic after startup. 5. Because registry metadata and SKILL.md disagree, prefer the code/README and consider asking the publisher (repo owner) for clarification or a release build with consistent metadata. If you cannot verify 'uv' or the metadata mismatch, treat this package with caution and run it isolated or not at all.

Find places, Go fast

Search for nearby places using a local Google Places API proxy. Two-step flow: resolve location first, then search.

Setup

cd {baseDir}
echo "GOOGLE_PLACES_API_KEY=your-key" > .env
uv venv && uv pip install -e ".[dev]"
uv run --env-file .env uvicorn local_places.main:app --host 127.0.0.1 --port 8000

Requires GOOGLE_PLACES_API_KEY in .env or environment.

Quick Start

1. Check server: curl http://127.0.0.1:8000/ping

2. Resolve location:

curl -X POST http://127.0.0.1:8000/locations/resolve \
  -H "Content-Type: application/json" \
  -d '{"location_text": "Soho, London", "limit": 5}'

3. Search places:

curl -X POST http://127.0.0.1:8000/places/search \
  -H "Content-Type: application/json" \
  -d '{
    "query": "coffee shop",
    "location_bias": {"lat": 51.5137, "lng": -0.1366, "radius_m": 1000},
    "filters": {"open_now": true, "min_rating": 4.0},
    "limit": 10
  }'

4. Get details:

curl http://127.0.0.1:8000/places/{place_id}

Conversation Flow

1. If user says "near me" or gives vague location → resolve it first
2. If multiple results → show numbered list, ask user to pick
3. Ask for preferences: type, open now, rating, price level
4. Search with location_bias from chosen location
5. Present results with name, rating, address, open status
6. Offer to fetch details or refine search

Filter Constraints

• filters.types: exactly ONE type (e.g., "restaurant", "cafe", "gym")
• filters.price_levels: integers 0-4 (0=free, 4=very expensive)
• filters.min_rating: 0-5 in 0.5 increments
• filters.open_now: boolean
• limit: 1-20 for search, 1-10 for resolve
• location_bias.radius_m: must be > 0

Response Format

{
  "results": [
    {
      "place_id": "ChIJ...",
      "name": "Coffee Shop",
      "address": "123 Main St",
      "location": {"lat": 51.5, "lng": -0.1},
      "rating": 4.6,
      "price_level": 2,
      "types": ["cafe", "food"],
      "open_now": true
    }
  ],
  "next_page_token": "..." 
}

Use next_page_token as page_token in next request for more results.