Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to provide local, real‑time filtering (distance modes, live queue/booking, updated hours, navigation). Those capabilities normally require access to mapping/geolocation services and review/booking APIs, yet the skill declares no integrations, binaries, or credentials. This gap means the skill's stated capabilities are not fully justified by its declared requirements.
Instruction Scope
SKILL.md lists outputs like实时排队情况 (live queue), 预约通道 (booking channels), 精准导航路径, and community image galleries — but gives no instructions for which APIs/websites to query, whether to prompt the user for location or permissions, or how to verify data freshness. The instructions are high‑level and assume access to external real‑time data without specifying sources or limits.
Install Mechanism
Instruction‑only skill with no install spec and no code files — low install risk. Nothing will be written to disk by an installer because there is no installer described.
Credentials
No environment variables or credentials are requested (good), but the functionality described typically requires third‑party API keys (maps, booking systems) or user location. If this skill is later extended to call those services it will need credentials; the current absence of any declared auth is a transparency gap rather than immediate overreach.
Persistence & Privilege
always is false and the skill is user‑invocable with model invocation allowed (normal). The skill does not request persistent platform privileges or modify other skills' config.
Scan Findings in Context
[no-findings] expected: The regex scanner found no code or suspicious patterns. This is expected because the skill is instruction‑only (SKILL.md). Absence of findings does not resolve the noted capability/integration gaps.
What to consider before installing
This skill describes useful local styling and shop‑filtering features but doesn't say how it will get live queue, booking, navigation, or review data. Before installing or using it, ask the publisher: (1) which data sources/APIs will be used (maps, booking platforms, review sites), (2) whether the skill will request your location or access to any accounts, and (3) whether it will require API keys or send data to third‑party endpoints. Prefer skills that list their data sources and required permissions; avoid giving location or credentials unless you trust where the data will be sent. If you plan to use it, test with non‑sensitive queries first and verify that results cite reputable sources.Like a lobster shell, security has layers — review code before you run it.
latestvk975e8ks09ygmgc7sfnxdsrh71834te5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.