车牌号码归属地 - 即刻数据

AdvisoryAudited by Static analysis on May 9, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Your Jike AppKey and the plate or prefix you query are transmitted to the external API service; if JIKE_API_BASE_URL is set, the destination can be changed from the default Jike endpoint.

Why it was flagged

The script uses an API credential and sends it with the user’s plate query to the configured API endpoint. This is purpose-aligned and disclosed, but it is still credential use that users should notice.

Skill content

API_BASE_URL = os.environ.get("JIKE_API_BASE_URL", "https://api.jikeapi.cn").rstrip("/") ... urllib.parse.urlencode({'plate_number': plate_number, 'appkey': appkey})

Recommendation

Use a dedicated Jike AppKey, keep it private, prefer environment variables over passing it on the command line on shared systems, and ensure JIKE_API_BASE_URL is unset or points only to a trusted endpoint.