Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Lap Airport Nearest Relevant

v1.0.0

Airport Nearest Relevant API skill. Use when working with Airport Nearest Relevant for reference-data. Covers 1 endpoint.

0· 115·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mickmicksh/lap-airport-nearest-relevant.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Lap Airport Nearest Relevant" (mickmicksh/lap-airport-nearest-relevant) from ClawHub.
Skill page: https://clawhub.ai/mickmicksh/lap-airport-nearest-relevant
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install lap-airport-nearest-relevant

ClawHub CLI

Package manager switcher

npx clawhub@latest install lap-airport-nearest-relevant
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, endpoint list, and base URL align with an airport-reference API skill. However the base URL is a commercial Amadeus test host (https://test.api.amadeus.com/v1) while the skill declares 'No authentication required' and requires no API key — that mismatch is suspicious and should be verified.
Instruction Scope
SKILL.md is instruction-only and stays narrowly focused on the single endpoint and where to find the API spec. It does instruct the agent to perform GET /reference-data/locations/airports and to use npx commands to fetch specs; it does not request reading unrelated files or credentials. The guidance to 'verify access' is vague and gives the agent broad discretion on how to call the API.
Install Mechanism
There is no install spec (instruction-only), so nothing will be written to disk by the skill itself. Note: the README suggests using 'npx @lap-platform/lapsh' — running npx will download and execute code from npm at runtime, which is a separate risk if the agent actually executes those commands.
!
Credentials
The skill requests no environment variables or credentials. Given the Amadeus base URL, it's common for that API to require client credentials; the absence of any declared auth or env vars conflicts with the likely real-world requirements of the API and could indicate an incomplete or inaccurate spec.
Persistence & Privilege
The skill does not request 'always: true' and has normal invocation settings. It does not declare any persistent configuration or system-level modifications.
What to consider before installing
Before installing, verify these points: 1) Confirm whether the referenced Amadeus endpoint actually requires an API key or other auth — the SKILL.md claims 'No authentication required' which is uncommon for that host. 2) Inspect the referenced 'references/api-spec.lap' (or fetch the official Amadeus spec) to confirm parameter and auth requirements. 3) If you or the agent will run the suggested 'npx @lap-platform/lapsh' commands, be aware npx fetches remote code from npm at runtime; only run that if you trust the package and its publisher. 4) Because the skill source/homepage are unknown, consider testing calls manually (curl/postman) against the API in a controlled environment before allowing autonomous agent use, and avoid sending any sensitive or unrelated data to the endpoint. If the owner or spec can confirm 'no auth required' and provide a canonical source, that would increase confidence.

Like a lobster shell, security has layers — review code before you run it.

latestvk97apttj4b1g1n30n1xehvrwc58570hg
115downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Airport Nearest Relevant

API version: 1.1.2

Auth

No authentication required.

Base URL

https://test.api.amadeus.com/v1

Setup

  1. No auth setup needed
  2. GET /reference-data/locations/airports -- verify access

Endpoints

1 endpoints across 1 groups. See references/api-spec.lap for full details.

reference-data

MethodPathDescription
GET/reference-data/locations/airportsReturns a list of relevant airports near to a given point.

Common Questions

Match user requests to endpoints in references/api-spec.lap. Key patterns:

  • "List all airports?" -> GET /reference-data/locations/airports

Response Tips

  • Check response schemas in references/api-spec.lap for field details

CLI

# Update this spec to the latest version
npx @lap-platform/lapsh get airport-nearest-relevant -o references/api-spec.lap

# Search for related APIs
npx @lap-platform/lapsh search airport-nearest-relevant

References

  • Full spec: See references/api-spec.lap for complete endpoint details, parameter tables, and response schemas

Generated from the official API spec by LAP

Comments

Loading comments...