Kiro Search Aggregator

Multi-source search skill for Kiro on OpenClaw. Aggregate and rank results from Google, Google Scholar, YouTube, and X, then output a concise brief.

Security Scan

The skill's requirements and code align with its stated multi-source search purpose; it calls the declared search APIs and only requests the expected API keys.

Purpose & Capability

Name/description ask for aggregated searches across Google, Scholar, YouTube, and X, and the package requires API keys and a python3 runtime which are appropriate and expected. The included script implements calls to Serper (google + videos), SerpAPI (google_scholar), and X recent search endpoints, matching the stated providers.

Instruction Scope

SKILL.md instructs running the included Python script with query/sources arguments. The script only reads the declared environment variables (SERPER_API_KEY, SERPAPI_API_KEY, X_BEARER_TOKEN), performs HTTP requests to the declared provider endpoints, and renders results to an outputs folder. There are no instructions to read unrelated system files or to transmit data to unexpected external endpoints.

Install Mechanism

No install spec is present (instruction-only skill with an included script). No external download/install steps are attempted. Requiring only python3 is proportionate.

Credentials

The skill requires three API credentials that directly map to its four data sources. The primaryEnv (SERPER_API_KEY) is consistent with Serper usage for google and youtube. No unrelated secrets or broad system credentials are requested.

Persistence & Privilege

always is false and the skill does not request elevated or persistent platform privileges. It writes output to a local outputs/search-aggregator/ folder (expected for this functionality) and does not modify other skills or system-wide configs.

Assessment

This skill appears to do what it claims: it runs a Python script that queries Serper, SerpAPI, and X using the API keys you provide and saves aggregated results locally. Before installing, confirm you trust the skill producer and understand that: (1) the API keys you supply allow the script to query those services (provide least-privilege/read-only tokens where possible); (2) results and snippets will be written to outputs/search-aggregator/, so avoid putting secrets into queries; and (3) we reviewed most of the script and saw only expected HTTP calls, but part of the main function was truncated in the provided snippet — if you want higher confidence, inspect the complete scripts/search_aggregator.py file to verify there are no additional outbound endpoints or surprising filesystem/network actions.

Plugin producer: kiroai.io

Aggregate search results across multiple providers and return one ranked list with a short summary.

Supported Sources

• google (Serper API)
• scholar (SerpAPI, google_scholar engine)
• youtube (Serper videos API)
• x (X recent search API)

API keys

Optional, per source:

• SERPER_API_KEY for google, youtube
• SERPAPI_API_KEY for scholar
• X_BEARER_TOKEN for x

Quick start

python3 skills/kiro-search-aggregator/scripts/search_aggregator.py \
  --query "AI agents workflow" \
  --sources "google,scholar,youtube,x" \
  --per-source 5

Output

Default folder: outputs/search-aggregator/

• latest.json: full machine-readable result
• latest.md: readable summary + top results