jike-geo

PassAudited by ClawScan on May 1, 2026.

Overview

No hidden malicious behavior is evident; the skill is a GEO platform connector, but it can use your API key to manage and delete data in that account.

Install this only if you intend to let the agent use your JIKE GEO account. Keep the API key private, verify product IDs before mutations, require confirmation for delete/update/upload actions, and review company information gathered from the web before it is saved.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent with this key can access the connected GEO account through the supported commands.

Why it was flagged

The script uses a declared API key as delegated account authority for calls to the GEO service.

Skill content

key = os.environ.get("JIKE_GEO_SECRET_KEY", "").strip() ... headers = { "X-API-Key": key,

Recommendation

Use a revocable API key, prefer protected environment-variable storage, and rotate the key if it is exposed.

Note

ASI02: Tool Misuse and Exploitation

What this means

A wrong product ID, article ID, image ID, or delete command could alter or remove content in the GEO account, or upload a selected local file.

Why it was flagged

The skill exposes create, update, delete, and upload operations for account resources; this is disclosed and purpose-aligned, but mistakes can change or remove data.

Skill content

产品管理 | `products list/create/get/update/delete` ... 图片管理 | `gallery images-list/upload/delete` ... 文章管理 | `articles list/get/update/delete`

Recommendation

Confirm product IDs and target records before update/delete/upload actions, and ask the agent to get explicit approval for destructive operations.

Note

ASI06: Memory and Context Poisoning

What this means

Incorrect or sensitive company details may persist in the GEO account and influence later generated content.

Why it was flagged

The workflow can save web-sourced company information into a persistent product profile that later drives generated questions and articles.

Skill content

主动通过联网搜索获取准确信息 ... `company save` 需要一次性完整填写公司信息，信息质量直接决定后续问题生成和文章生成的效果

Recommendation

Review web-sourced company fields before saving them, and update or delete stale profile data when it changes.