Route Assistant
v1.4.0Intelligent route planning assistant with smart filtering. Query driving, transit, taxi, walking routes with Amap API. Auto-filters infeasible options.
⭐ 0· 381·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes using Amap Geocoding and Directions APIs (external network calls). However, the skill metadata declares no required environment variables, no primary credential, and no config paths for an Amap API key. Calling Amap legitimately requires an API key — the omission is an inconsistency. Additionally, _meta.json advertises version 1.0.0 while the registry metadata lists 1.4.0, a minor mismatch in packaging.
Instruction Scope
The instructions are high-level and confined to routing: geocoding, direction queries, filtering, and formatting results. They do not instruct reading local files or unrelated system state, nor do they direct data to unexpected third-party endpoints beyond Amap. However, they are vague about how origin/destination extraction and API authentication happen (where the key comes from), leaving broad discretion to the agent.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — nothing is written to disk and no third-party packages are pulled in. That minimizes install-time risk.
Credentials
The skill will need an Amap API key to function, yet requires.env and primary credential fields are empty. This is disproportionate/ambiguous: either the skill expects the platform to provide credentials implicitly (not documented) or it will attempt to use any available environment variables or secrets in the agent environment. Both possibilities are risky without explicit declaration of the required credential name and least-privilege guidance.
Persistence & Privilege
always is false, there are no config paths requested, and the skill does not request persistent presence or system-level changes. Agent autonomy (model invocation) remains enabled by default — normal for skills.
What to consider before installing
Before installing: (1) Ask the maintainer how the skill authenticates to Amap — it should require you to supply an API key via a named env var (e.g., AMAP_API_KEY or AMAP_KEY). Do not proceed if the skill expects to automatically use platform/global secrets. (2) Verify the skill only calls Amap endpoints (list exact hostnames, e.g., restapi.amap.com) and does not phone home to other domains. (3) Prefer a skill that documents the exact env var name and the expected permission scope for the API key. (4) If you must test it, run it in a restricted environment (no access to sensitive env vars or credentials). (5) If the maintainer cannot explain the missing API-key declaration or provides unclear answers, treat the omission as a red flag and avoid installing.Like a lobster shell, security has layers — review code before you run it.
latestvk979xkvkbxq5djnx1gv2stdbhh824wg4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.