Baidu Maps Sse
v0.1.0Auto-generated skill for baidu-maps-sse tools via OneKey Gateway.
⭐ 0· 89·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name, description, Python scripts, and declared dependency on the OneKey Gateway all align: the code builds a OneKeyAgentRouter and forwards map-related api_id calls (geocode, directions, etc.) to the gateway. Minor mismatch: the maps_search_places tool description mentions "Google Places API" while the package is named "baidu-maps-sse" — this appears to be a documentation/copy-paste inconsistency but does not change runtime behavior.
Instruction Scope
SKILL.md and the scripts contain limited, well-scoped instructions: read a JSON payload (or file), validate required fields, and invoke the OneKey router. The scripts only read the DEEPNLP_ONEKEY_ROUTER_ACCESS env var and the provided payload; they do not read other system files or credentials. Note: the SKILL.md and scripts default to a demo key (BETA_TEST_KEY_MARCH_2026) if you do not set your own key, meaning payloads will be routed via the gateway even without you configuring a key.
Install Mechanism
No arbitrary download/install URLs are embedded. The SKILL.md recommends installing an npm package (@aiagenta2z/onekey-gateway) and a pip package (ai-agent-marketplace). These are registry installs (npm/pypi) rather than remote archive downloads — typical and proportionate to the skill's function. There is no install script included in the package that writes arbitrary files.
Credentials
The skill requests only one environment variable (DEEPNLP_ONEKEY_ROUTER_ACCESS), which is appropriate for a gateway-based wrapper. However, that single key is powerful: it authorizes use of the OneKey Gateway and therefore can be used to access any APIs or services the gateway exposes on your behalf. Also, because the code falls back to a public demo key if you don't set one, your requests (and any data you send as payloads) would go through the provider's demo routing unless you explicitly set your own key. Consider whether you trust the gateway operator to handle any data you send.
Persistence & Privilege
The skill does not request always: true, does not modify other skills' configuration, and does not persist state or install background services. It will not be force-included in all agent runs and does not ask for elevated OS-level privileges.
Assessment
This skill is a thin wrapper that forwards map-related requests to the OneKey Gateway. Before installing: (1) Confirm you trust the OneKey Gateway operator (deepnlp/OneKey) because the DEEPNLP_ONEKEY_ROUTER_ACCESS key grants the gateway the ability to make API calls and see payload data; (2) set your own API key rather than relying on the demo fallback to avoid routing data through a shared demo account; (3) review the npm and pip packages referenced (@aiagenta2z/onekey-gateway, ai-agent-marketplace) from the registries to ensure they are what you expect; (4) be aware of the small documentation inconsistency ("Google Places API" vs "baidu-maps-sse") — this looks like a copy-paste doc issue but not a functional mismatch. If you need higher assurance, ask the skill author for source/origin information or a signed/published homepage for the packages before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk97bk28rznvrz2xnf9tbqf75cd83de73
License
MIT-0
Free to use, modify, and redistribute. No attribution required.