OpenClaw大众点评
v1.0.0查询大众点评餐厅信息。使用场景：(1) 用户要查询某家餐厅的评分、人均消费、地址 (2) 用户要搜索特定菜系或区域的餐厅推荐 (3) 用户要获取附近美食推荐。登录账号：一定S。重要：搜索时URL需包含城市ID（如hangzhou页面），账号定位北京时需使用URL参数方式绕过。
⭐ 0· 130·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Dianping restaurant queries) match the SKILL.md instructions (open dianping hangzhou page, perform searches, extract restaurant info). The skill does not request unrelated binaries, env vars, or installs. Note: the SKILL.md references a specific login account name ('一定S') but the skill does not provide credentials — this is a usability/detail issue rather than a functional mismatch. Also the _meta.json ownerId differs from the registry ownerId provided in the manifest, which is an inconsistency in metadata (not necessarily malicious).
Instruction Scope
Instructions instruct the agent to use the browser tool, open https://www.dianping.com/hangzhou, check login state, search, and extract fields (name, rating, price, address, descriptions, reviews). This is within scope. Two things for users to note: (1) the SKILL.md says to verify a login and, if not logged in, request the user's phone number and verification code — asking users to enter OTPs or phone numbers is a privacy-sensitive action; (2) it explicitly tells the agent to use browser.tabs to view all open pages, which could allow the skill to read content from other open tabs if the platform's browser tool exposes them. These are privacy considerations but coherent with the stated scraping/task purpose.
Install Mechanism
Instruction-only skill with no install spec and no bundled code — minimal disk/system footprint. Lowest risk from install perspective.
Credentials
The skill declares no required environment variables, no credentials, and no config paths. The SKILL.md's request to use a logged-in Dianping account (and possibly prompt the user for phone/OTP) is proportional to the task of accessing content behind login, but it is a sensitive operation that relies on user-provided authentication rather than skill-managed credentials.
Persistence & Privilege
always is false and the skill doesn't request elevated persistence. disable-model-invocation is default (skill can be invoked autonomously), which is normal and not by itself a concern. The skill does not instruct modification of other skills or system configs.
Assessment
This skill appears to do what it says: open Dianping pages for a specified city and extract restaurant info. Before installing, consider: (1) it asks the agent to check login status and — if not logged in — to prompt you for phone number and verification codes. Do not share OTPs or credentials with untrusted agents; prefer logging in yourself in the browser session the agent will use. (2) The instructions call browser.tabs to enumerate open pages; be aware the skill may be able to read other open tabs if the platform's browser integration exposes them — close unrelated tabs you don't want the agent to see. (3) The skill metadata has minor inconsistencies (ownerId differs between manifest and _meta.json, no homepage, unknown source). These are red flags about provenance but not necessarily malicious. If provenance matters, ask the publisher for clarification or prefer a skill from a known source. Otherwise the skill is internally consistent and minimal-risk from an installation perspective.Like a lobster shell, security has layers — review code before you run it.
latestvk97anfdd9vs3yzgyz1jsaes7c983mnzc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.