Ikuzo - The Map Editor
v2.1.3Manage maps, spots, and travel plans on Ikuzo (ikuzo.app) — a location-based exploration app. Use when creating/editing maps, adding/searching spots, planning trips with day-by-day itineraries, finding nearby places, or managing travel logistics. Triggers on map management, spot tracking, trip planning, location discovery, and "where should I go" questions.
⭐ 0· 967·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The declared purpose (map/spot/trip management for Ikuzo) matches the API surface described in SKILL.md (maps, spots, travels). However, SKILL.md requires a Bearer token for the API but the registry metadata lists no required environment variables or primary credential — that is inconsistent. A legitimate integration would normally declare a required API token (e.g., IKUZO_API_TOKEN).
Instruction Scope
The SKILL.md is instruction-only and confined to JSON-RPC calls to https://ikuzo.app/api/mcp and schema lookups. It does not instruct reading arbitrary system files or running local binaries. However it refers to Auth: 'Bearer token (from TOOLS.md or user config)', which is vague and could lead the agent to search for stored credentials or tooling documentation — this ambiguity expands the agent's scope unless clarified.
Install Mechanism
No install spec and no code files are included (instruction-only), so nothing will be written to disk or automatically installed by the skill itself. This is the lowest-risk install profile.
Credentials
Although the skill needs an API bearer token to operate, the skill declares no required environment variables or primary credential. The SKILL.md's suggestion to fetch the token 'from TOOLS.md or user config' is not justified by the registry metadata and could encourage credential lookup in unspecified places. The absence of a declared, scoped credential is disproportionate to the described functionality.
Persistence & Privilege
The skill does not request always:true and has no install or config-writing behavior described. It does not request elevated or persistent system privileges in the manifest.
What to consider before installing
Before installing, ask the publisher to clarify and fix the credential handling: they should declare an explicit required credential (for example IKUZO_API_TOKEN) or document exactly where the token comes from (and why the agent should not search arbitrary user config files). Verify the endpoint https://ikuzo.app is legitimate and that the token scope is least-privilege. Avoid pasting secrets into free-text chat — supply API tokens through the platform's secure credential mechanism. If you must test the skill, use a limited test account/token and confirm it only accesses maps/spots you expect (note that spots_nearby can search across all 'accessible' maps). If the publisher cannot provide a clear credential and privacy model, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
editorvk972n8w53s56bxmywx0qz83rk180ymb4ikuzovk972n8w53s56bxmywx0qz83rk180ymb4latestvk972n8w53s56bxmywx0qz83rk180ymb4mapvk972n8w53s56bxmywx0qz83rk180ymb4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.