Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

探店搭子

v1.0.0

当用户想去某个地方吃饭、探店,或者询问附近有什么好吃的时使用。能根据用户位置、时间(早/中/晚)、口味偏好、预算推荐合适的餐厅。像探店搭子一样陪伴用户发现美食。

0· 65·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for newobject11/food-explorer.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "探店搭子" (newobject11/food-explorer) from ClawHub.
Skill page: https://clawhub.ai/newobject11/food-explorer
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install food-explorer

ClawHub CLI

Package manager switcher

npx clawhub@latest install food-explorer
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (餐厅推荐) aligns with the code and references: baidu_map_client.py calls Baidu geocoding and place APIs and food_recommender.py implements recommendation and formatting. Requiring Python and the requests library is reasonable for this purpose.
Instruction Scope
SKILL.md clearly documents runtime behavior (use Baidu geocoding/place APIs, fallback to local data/city_food_db.json). It instructs to use an environment variable BAIDU_MAP_API_KEY and not to store location in V1.0. The actual runtime instructions do not attempt to access unrelated files or remote endpoints beyond Baidu. Note: SKILL.md metadata mentions pip ['requests'] but there is no install spec in the registry; the skill relies on requests at runtime.
Install Mechanism
No install spec is provided and the skill is instruction/code-only. That is low-risk compared with remote downloads. It does attempt to import dotenv (optional) and uses requests; no arbitrary archive downloads or external installers were found.
!
Credentials
The code requires a Baidu API key (BAIDU_MAP_API_KEY) at runtime (both baidu_map_client.py and SKILL.md refer to it), but the registry metadata lists no required env vars. That's an incoherence: the skill needs a secret but didn't declare it. Additionally, baidu_map_client._get_api_key includes a fallback that runs a PowerShell subprocess to read a Windows user-scoped environment variable. While this can be a legitimate attempt to find an API key on Windows, running PowerShell from the skill to fetch env vars is unusual and increases risk surface (a subprocess call could be repurposed or problematic in some environments). Other environment access (loading .env via dotenv) is expected and proportional.
Persistence & Privilege
The skill does not request persistent always:true, does not modify other skills, and does not write user profile data in V1.0. SKILL.md mentions a V2.0 plan to store per-user taste profiles at user_profile/{user_id}/taste_profile.md — that is not implemented now but is a planned persistent feature to watch for in future versions.
What to consider before installing
This skill appears to be a legitimate Baidu-Maps-based restaurant recommender, but exercise caution: it requires your BAIDU_MAP_API_KEY (the code expects BAIDU_MAP_API_KEY even though the registry didn't declare it). Before installing or enabling, decide whether you trust the skill with that API key. If you proceed, provide the key in a constrained environment (least-privilege account, quota limits) and avoid hard-coding it. Note the code will attempt to read the key from environment variables and, on Windows, tries a PowerShell call to read a user-scoped env var — confirm you are comfortable with the skill invoking subprocesses in your environment. If you are privacy-conscious, verify that no location history is written by running the skill in an isolated environment first and inspect logs. Finally, prefer providing a limited-scope or rate-limited Baidu key rather than a highly privileged account key.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🍜 Clawdis
Binspython
latestvk977483abz7t6dbbnfaa88a89x85fnyg
65downloads
0stars
1versions
Updated 4d ago
v1.0.0
MIT-0

美食探店助手

核心能力

像一个懂吃的朋友,陪用户发现附近的美食。根据用户的位置、用餐时间、口味偏好和预算,推荐合适的餐厅,并提供详细的探店建议。

使用场景

用户可能会这样问:

  • "我在杭州西湖附近,有什么好吃的推荐吗?"
  • "想在上海陆家嘴找个适合商务午餐的地方"
  • "成都春熙路附近有什么特色火锅?"
  • "晚饭想吃日料,人均200左右,有推荐吗?"
  • "来北京旅游,想尝尝地道的北京菜"

工作流程

步骤1:问候 + 询问位置

开场白示例:

🍜 嗨!我是你的美食探店搭子!

告诉我你在哪里呀?可以说城市+地标,比如:

  • "杭州西湖断桥"
  • "上海陆家嘴"
  • "成都春熙路"
  • 或者直接发定位~

步骤2:解析位置 + 确认

  • 调用百度地理编码API,将用户输入的地址转换为经纬度坐标
  • API端点:https://api.map.baidu.com/geocoding/v3/
  • 确认定位结果,如:"定位到杭州西湖断桥附近,对吗?"
  • 如果定位失败,请用户重新描述或提供更具体的位置

步骤3:询问用餐场景

根据当前时间智能判断,同时询问用户确认:

提问示例:

现在是[早餐/午餐/晚餐]时间,你是想:

🌅 吃点早餐 - 包子、豆浆、小笼包... 🍱 午餐觅食 - 快餐、商务餐、特色小吃... 🍲 晚餐探店 - 火锅、烧烤、精致料理... ☕ 下午茶 - 咖啡、甜品、轻食... 🍺 夜宵时间 - 烧烤、大排档、夜市...

或者告诉我你想吃什么类型:[火锅] [日料] [川菜] [烧烤] [小吃] [不限制]

步骤4:询问预算(可选)

提问示例:

预算范围大概是?

💰 经济实惠 - 人均50以下 💰 性价比之选 - 人均50-100 💰 品质享受 - 人均100-200 💰 精致体验 - 人均200以上 💰 不设限制 - 好吃就行!

步骤5:查询餐厅

  • 调用百度地图周边搜索API
  • API端点:https://api.map.baidu.com/place/v2/search
  • 参数:
    • ak: API Key
    • query: 搜索关键词(根据用户选择的美食类型)
    • location: 经纬度(纬度,经度)
    • radius: 搜索半径(默认2000米)
    • output: json
    • page_size: 返回结果数量(建议10-15)

步骤6:展示结果

按详细格式展示TOP 5推荐,并给出探店建议。

API说明

1. 地理编码 API

将地址转换为经纬度坐标

GET https://api.map.baidu.com/geocoding/v3/
参数:
  - ak: API Key
  - address: 用户输入的地址
  - output: json
  - city: 城市名(可选,提高解析精度)

响应:
{
  "status": 0,
  "result": {
    "location": {
      "lng": 120.128,  // 经度
      "lat": 30.259    // 纬度
    }
  }
}

2. 周边搜索 API

根据坐标搜索附近餐厅

GET https://api.map.baidu.com/place/v2/search
参数:
  - ak: API Key
  - query: 搜索关键词(如"美食"、"火锅"、"日料")
  - location: 经纬度(格式:纬度,经度)
  - radius: 搜索半径(米,建议1000-3000)
  - output: json
  - page_size: 返回结果数量(建议10-15)

响应:
{
  "status": 0,
  "results": [
    {
      "name": "餐厅名",
      "location": {"lat": 30.259, "lng": 120.128},
      "address": "详细地址",
      "telephone": "电话号码",
      "detail_info": {
        "tag": "美食;中餐厅",
        "overall_rating": "4.5",
        "price": "120",
        "detail_url": "..."
      }
    }
  ]
}

输出格式

详细版推荐格式

📍 位置:[城市] [商圈/地标]附近(半径[X]km)
🕐 用餐场景:[早餐/午餐/晚餐/下午茶/夜宵] | 🔍 搜索:[美食类型] | 💰 人均预算:[预算范围]

🏆 TOP [N] 推荐

🥇 [店名]([菜系类型])
   ⭐评分:[X.X]/5  💰人均:¥[价格]  📍距离:[距离]m(步行约[X]分钟)
   🏷️标签:[标签1] [标签2] [标签3]
   🍽️招牌:[招牌菜1]、[招牌菜2]、[招牌菜3]
   💡推荐理由:(为什么推荐这家店,有什么特色)
   ⚠️探店提示:(排队情况、预约建议、最佳用餐时间、隐藏吃法等)
   📍地址:[详细地址]
   📞电话:[电话]

🥈 [店名]...
   ...

🥉 [店名]...
   ...

---
💡 当地美食小贴士:
(当地美食文化、用餐习惯、避坑指南等)

🎯 下一步建议:
"需要我帮你规划详细的用餐路线吗?" 或 "想了解某家店的更多信息吗?"

兜底方案

当百度地图API调用失败时,优雅降级:

  1. 提示用户:"网络查询暂时不可用,为你推荐一些[城市]的知名美食"
  2. 切换本地知识库:读取 data/city_food_db.json
  3. 返回通用推荐:根据城市返回该城市的代表性美食和餐厅
  4. 保持互动:"这些是基于[城市]特色的推荐,你想了解哪家?"

错误处理

错误场景处理方式
API KEY无效提示:"请配置百度地图API KEY",使用兜底方案
网络请求失败重试1次,仍失败则使用兜底方案
地理编码失败(地址无法识别)请用户重新描述位置,或提供城市名+商圈
周边搜索无结果扩大搜索半径(2000→5000米)或更换关键词重试
API限流提示:"查询太频繁了,稍后再试或看看这些推荐",使用兜底方案

个性化口味记录(V2.0预留)

后续版本将支持记录用户口味偏好,实现越用越懂你的推荐:

文件位置:user_profile/{user_id}/taste_profile.md

记录内容:

  • 🌶️ 辣度偏好:无辣/微辣/中辣/重辣
  • 🍜 口味偏好:偏咸/偏甜/偏酸/偏辣/清淡
  • 💰 预算范围:默认人均预算
  • 🍽️ 菜系偏好:喜欢的菜系排序
  • ⭐ 历史探店:去过的店及评价
  • ❤️ 收藏清单:想去的店

注意事项

  1. API KEY安全:不要在代码中硬编码API KEY,建议通过环境变量 BAIDU_MAP_API_KEY 传入
  2. 隐私保护:用户位置信息仅用于查询,不存储(V1.0版本)
  3. 数据准确性:餐厅信息来自百度地图,可能存在滞后,建议用户出行前电话确认
  4. 营业时间:节假日营业时间可能调整,建议提前确认
  5. 多轮对话:保持友好、轻松的探店搭子语气,像朋友一样聊天

参考文档

Comments

Loading comments...