Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Air Route Calculator - Projected Flight Maps

v1.3.22

Use when the user wants aviation route maps, ETOPS-aware route analysis, projection comparisons, airport lookup, or SVG map rendering through a local Circulu...

0· 101·0 current·0 all-time
byGerald He@skylinehk
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the asset contents and instructions. All declared behavior (route solving, ETOPS, projection, SVG rendering) is supported by the provided docs and example payloads. No requested env vars, binaries, or unrelated capabilities are present.
Instruction Scope
SKILL.md instructs the agent to talk to a local MCP endpoint, use specific MCP tool calls (map.solve_query, map.solve_spec, etc.), and avoid proxying arbitrary URLs. It references local paths and startup commands only; it does not instruct reading unrelated files or exfiltrating data.
Install Mechanism
No install spec or remote downloads are present — this is an instruction-only skill with documentation on running the local app (npm run dev / npm run mcp:dev). No archives or external URLs are used for installs.
Credentials
No required env vars, credentials, or config paths are declared. references/local-setup.md suggests local env vars for convenience, but these are optional and local-only; nothing requests secrets or unrelated service credentials.
Persistence & Privilege
The skill is not marked always:true and does not request elevated platform privileges. The included agents/openai.yaml sets allow_implicit_invocation: false for that agent, while platform flags show the normal default (disable-model-invocation: false); there is no evidence the skill modifies other skills or system-wide settings.
Assessment
This package appears to be a local/offline-only Circulus MCP client and is coherent with its description. Before using it: (1) verify you run the MCP worker locally at http://127.0.0.1:8788/mcp (the skill expects that endpoint); (2) you'll need to run the project locally (npm run dev / npm run mcp:dev) — the skill does not auto-install anything; (3) confirm the MCP URL is localhost and not repointed to an external host (if someone changes the MCP endpoint to a remote server, the agent could send local queries off-host); and (4) note the skill requests no credentials and is suitable for air-gapped or privacy-sensitive workflows. If you need higher assurance, inspect the actual running MCP worker code (not included here) before sending sensitive data through it.
!
agents/openai.yaml:14
Install source points to URL shortener or raw IP.
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Like a lobster shell, security has layers — review code before you run it.

aviationvk977c5e7kqksc1c5y51vzb5h1x83bgmplatestvk97a90n8p5m05vg1v2wbx2da2h83bpqtmapsvk977c5e7kqksc1c5y51vzb5h1x83bgmpmcpvk977c5e7kqksc1c5y51vzb5h1x83bgmpofflinevk977c5e7kqksc1c5y51vzb5h1x83bgmptravelvk977c5e7kqksc1c5y51vzb5h1x83bgmp
101downloads
0stars
4versions
Updated 4w ago
v1.3.22
MIT-0

Circulus Map - air route calculation with projected map

Use this skill when the task is about aviation route planning, map projections, airport lookup, ETOPS, or generating shareable SVG route maps through a local Circulus Map setup.

Hosted destination (next release)

Quick start

  • Before using tools, make sure the local app is running with npm run dev and the MCP worker is running with npm run mcp:dev.
  • Expect the local MCP endpoint at http://127.0.0.1:8788/mcp.
  • For simple requests, call map.solve_query with shorthand input like JFK-LHR or 800nm@DEN.
  • For advanced requests, build a MapSpecV1 object and call map.solve_spec.
  • Use map.search_locations before solving when the user is unsure about codes or city names.
  • Use map.get_airport when you need a single airport record with coordinates and runway metadata.
  • Use map.render_svg only after the route/spec is stable.

Tool selection

  • map.search_locations: best first step for ambiguous airport/city input.
  • map.solve_query: fastest path for route-only requests and simple range rings.
  • map.solve_spec: use when the user cares about projection, ETOPS, labels, markers, or multiple paths.
  • map.list_scenarios: use when the user asks for examples or wants a starting point.
  • map.render_svg: use for final export-ready output, not exploration.

Resources

  • Read circulus://mapspec/schema before authoring a non-trivial MapSpecV1.
  • Read circulus://projection/guide for projection choices.
  • Read circulus://scenario/catalog and circulus://api/examples when you need examples quickly.

References

  • For local setup details and offline packaging expectations, read references/local-setup.md.
  • For quick query and spec-writing guidance, read references/mapspec.md.
  • For sample payloads, inspect assets/examples when bundled with this skill package.

Guardrails

  • Stay within the MCP tool surface; do not invent unsupported write operations.
  • Do not ask the MCP server to proxy arbitrary URLs or tile providers.
  • Prefer map.solve_query over map.solve_spec unless explicit control is needed.
  • If the local MCP server is unreachable, help the user restore the local app and worker before retrying tool calls.

Comments

Loading comments...