坐标转换

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward local GeoJSON coordinate conversion skill, with only a minor note that it asks users to install an unpinned Python dependency.

This skill is reasonable to install if you need local GeoJSON coordinate conversion. Review the input and output file paths before running it, and install the `pyproj` dependency from a trusted source.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing an unpinned package may pull whatever version is current from the package source at install time.

Why it was flagged

The skill relies on a manually installed Python package without a version pin or install specification. This is expected for the coordinate-conversion purpose, but it is still a dependency provenance consideration.

Skill content

pip3 install pyproj

Recommendation

Install `pyproj` from a trusted package index and consider pinning a known-good version if reproducibility matters.