情境感知生活助手 — GroundAPI
v1.0.0Context-aware daily assistant — auto-detect user location via IP, provide local weather, track packages, and offer lifestyle tips. Powered by GroundAPI MCP t...
⭐ 0· 33·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (context-aware assistant: IP location, weather, logistics, lifestyle tips) match the declared requirement (one GROUNDAPI_KEY) and the runtime calls (life_ip, life_weather, life_logistics, info_news). No unrelated credentials or binaries are requested.
Instruction Scope
SKILL.md is instruction-only and stays within the stated domain (calls GroundAPI MCP tools for IP, weather, logistics, news). It directs automatic triggering on casual greetings and to call life_ip() when no city is provided, which means the agent will resolve the user's location via IP and send that to GroundAPI. It also instructs asking for the recipient's phone-last-4 for certain courier verification — a legitimate but privacy-sensitive data request. There are no instructions to read unrelated local files or environment variables.
Install Mechanism
No install spec and no code files; instruction-only skills have minimal attack surface since nothing is written to disk by the skill itself.
Credentials
Only a single API key (GROUNDAPI_KEY) is required and is the declared primary credential. That is proportionate for a third-party API-based assistant. The SKILL.md example shows the key used in an MCP server config, which is consistent with the skill's operation.
Persistence & Privilege
Skill is not forced always-on (always: false) and does not request elevated system privileges. However, it requires the operator to add a GroundAPI MCP server entry to the agent's mcpServers config (the example includes the key), which gives that external service the ability to handle tool calls — users should be aware that outgoing requests and any data sent to GroundAPI will be routed there.
Assessment
This skill appears coherent and does what it says, but it will: (1) call GroundAPI endpoints for IP geolocation (so your IP/location is sent to that service), (2) for some couriers ask for the recipient's phone-number last 4 digits (sensitive PII). Before installing: verify GroundAPI (https://groundapi.net) and its privacy policy; use a scoped or revocable API key if possible; limit the agent's autonomous invocation or set prompt-level consent for auto-triggering on casual greetings; avoid giving unnecessary PII during tests; and monitor network usage or test with non-sensitive examples to confirm behavior. If you rely on strict privacy, consider disabling automatic triggers and require explicit user confirmation before calling external services.Like a lobster shell, security has layers — review code before you run it.
latestvk974n4r9vs1995a4dcq8es4nh58453sp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌤️ Clawdis
EnvGROUNDAPI_KEY
Primary envGROUNDAPI_KEY