Back to skill
Skillv1.0.0
ClawScan security
Amap City Checkin · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 15, 2026, 1:30 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is internally coherent: it only requires an Amap API key and its instructions describe calling Amap web-service APIs to build POI lists and produce a personal-map QR code.
- Guidance
- This skill appears to do what it says: use your Amap API key to query Amap services and generate a personal-map QR code. Before installing, verify you trust the skill source (SKILL.md claims 高德开放平台 but the package has no homepage or known publisher). Use a restricted API key (limit to the Web Service APIs and to appropriate referrers/IPs if possible), monitor quota usage, and avoid supplying any personal location or identity beyond the city name. If you need higher confidence, ask the publisher for a homepage or official attribution and verify the key permissions required for maps_schema_personal_map.
Review Dimensions
- Purpose & Capability
- noteThe name/description (generate city check-in maps) align with the declared requirement (AMAP_API_KEY) and the SKILL.md's explicit use of Amap Web Service endpoints. Minor mismatch: the SKILL.md lists author as '高德开放平台' but the package source/homepage are unknown — this is a provenance/branding question, not a functional mismatch.
- Instruction Scope
- okRuntime instructions are limited to calling Amap REST endpoints (district, place/text, place/around, place/detail, geocode, maps_schema_personal_map) using the provided API key. The skill does not instruct reading other env vars, system files, or user data beyond the city name. The privacy claim (no storage of user info) cannot be verified from an instruction-only skill, but there is no instruction that implies collecting unrelated secrets or files.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files — nothing is written to disk or downloaded by the skill itself, which lowers installation risk.
- Credentials
- okOnly a single environment variable (AMAP_API_KEY) is required and declared as the primary credential — this is appropriate and expected for a skill that calls Amap web services. No other credentials or sensitive env vars are requested.
- Persistence & Privilege
- okalways is false and the skill does not request persistent or system-wide privileges. Model/autonomous invocation is enabled by default (normal for skills) and is not combined with other red flags.