Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (Amap Web Service: search, weather, routing) align with the runtime instructions which call Amap endpoints. The SKILL.md and its embedded metadata require an AMAP_KEY and curl, which are appropriate. However, the registry metadata at the top of the report lists no required env vars or binaries — that discrepancy between registry fields and SKILL.md is inconsistent and should be reconciled.
Instruction Scope
SKILL.md contains concrete curl commands to official Amap endpoints and explicitly instructs the agent to read a single environment variable (AMAP_KEY). It does not ask the agent to read unrelated files, other credentials, or to transmit data to unexpected endpoints.
Install Mechanism
This is an instruction-only skill with no install spec (low risk). The SKILL.md metadata declares a dependency on curl; the absence of an install block means the environment must already provide curl. The registry summary omitted this dependency — check that the runtime environment provides curl or the agent will fail.
Credentials
The only secret the skill needs is AMAP_KEY (a Web Service API key), which is proportionate for calling Amap's APIs. The inconsistency: the top-level registry said 'Required env vars: none' while SKILL.md instructs users to set AMAP_KEY. Ensure the platform will supply the environment variable as documented and that it won't be logged or exposed.
Persistence & Privilege
The skill does not request always:true, has no install script, and does not seek persistent system-wide privileges. It is user-invocable and can be called autonomously (default platform behavior), which is expected for a service-integration skill.
Assessment
This skill appears to do what it claims: it issues curl requests to official Amap API endpoints and needs a single API key (AMAP_KEY). Before installing, confirm: (1) you will provide AMAP_KEY as an environment variable and the platform will not log or expose it; (2) the runtime has curl available (the SKILL.md metadata requires it); (3) you are comfortable with the Amap key's permissions and rate limits — avoid using a highly privileged or shared key. Also ask the publisher or registry admin to fix the metadata mismatch (registry fields vs SKILL.md) so required env vars and binaries are accurately declared. If the skill later requests additional credentials, downloads code from external URLs, or obtains always:true, re-evaluate (these would raise the risk).Like a lobster shell, security has layers — review code before you run it.
latestvk97338gnh4cev6n4b3zvscm2bd80540r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🗺️ Clawdis
Binscurl
Primary envAMAP_KEY