Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Citywalk Map

v2.0.7

生成基于OpenStreetMap和OSRM步行路线的Citywalk地图HTML,支持自定义主题色,自动适配全屏并输出详细步行数据与站点信息。

0· 118·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (generate OSM+OSRM walking-route HTML with theme and screenshots) matches the code: generate.py builds routes using OSRM and Nominatim and writes /tmp/citywalk_map.html. However there are mismatches: SKILL.md and some docs claim 'zero dependencies' (Python stdlib + curl) while scripts/render.py requires third-party packages (requests, Pillow). README.md mentions an automatic Gaode (Amap) tile fallback for China but the code uses openstreetmap.fr tiles and does not implement the claimed automatic switch. package.json version (3.1.0) and repository metadata also differ from registry metadata (2.0.7). These inconsistencies look like sloppy packaging rather than outright malicious intent, but they are unexplained.
Instruction Scope
Runtime instructions direct the agent/user to run scripts/generate.py (expected). The tool performs multiple network calls (router.project-osrm.org, nominatim.openstreetmap.org, wttr.in, OSM tile servers) which are necessary for routing/tiles/weather. The SKILL.md instructs starting a local Python http.server and later uses pkill -f to stop it; pkill may terminate other matching processes on the host if used carelessly. The code does not read arbitrary system files or request unrelated credentials.
Install Mechanism
No install spec is provided (instruction-only), which is low-risk, but the bundle includes executable scripts. render.py has non-standard dependencies (requests and Pillow) that are not installed automatically and contradict the 'zero dependencies' claim — if a user tries to run render.py without installing these libs it will fail. No external archives or obscure download URLs are used in the bundle itself.
Credentials
The skill requests no credentials or sensitive environment variables. An optional COLOR env var controls theme color; otherwise it does not require secrets. The code copies the environment when launching subprocesses but does not exfiltrate env vars. Network access is used for public mapping/weather services only.
Persistence & Privilege
The skill does not request persistent or elevated privileges. always is false. It writes output to /tmp and suggests running a local http.server; it does not modify other skills or system-wide agent settings.
What to consider before installing
What to consider before installing/using: - Functional correctness: generate.py is the primary script and should work with curl and Python 3. render.py requires third-party Python packages (requests, Pillow). If you don't want to install extra packages, avoid running render.py. - Dependency claim mismatch: the docs claim 'zero dependencies' but render.py contradicts that. Verify and install only what you trust (pip install requests Pillow) in an isolated environment if needed. - Network activity: the tool will make outbound requests to router.project-osrm.org (OSRM), nominatim.openstreetmap.org (reverse geocoding), wttr.in (weather), and OSM tile servers. These are expected for map generation, but be aware of rate limits and privacy (coordinates sent to public services). - pkill usage: the suggested screenshot flow uses pkill -f 'http.server 18767' — this can kill any matching process. Run the server/stop commands manually or use a safer method (record PID and kill that PID) to avoid terminating unrelated processes. - Packaging inconsistencies: package.json version and registry metadata do not match; README mentions Gaode (Amap) fallback not implemented in code. Treat these as quality issues; review the code locally before running. - Safety tip: run the scripts in a sandboxed or disposable environment (container/VM) if you have concerns, and do not expose sensitive environment variables while testing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cjx8ghxjwfcf6za8n5ww57h83f87amapvk9703gnpj2117dy8zpgrb2resx838538osrmvk9703gnpj2117dy8zpgrb2resx838538routevk9703gnpj2117dy8zpgrb2resx838538travelvk9703gnpj2117dy8zpgrb2resx838538walkingvk9703gnpj2117dy8zpgrb2resx838538
118downloads
0stars
8versions
Updated 3w ago
v2.0.7
MIT-0

Citywalk Map Skill | 城市步行路线图生成器

无需API!零成本生成真实 OSM 地图 + OSRM 步行路线的精美 Citywalk 路线图,一行命令搞定自定义主题色、全屏布局、详细步行数据


为什么选择我们?| Why Us?

对比项其他方案(API/MCP)我们的方案
成本需申请 API Key、付费、限流零成本,curl + OSM 公开接口
部署需服务器中转、签权直接本地生成,文件输出
地图商业地图 API(有水印/限制)OSM 真实地图,无水印
截图需额外截图服务OpenClaw browser 一键截图
定制API 返回固定样式HTML/CSS 完全可控
上手写代码调用 API一行命令就搞定

功能 | Features

  • 🌏 零成本:无 API Key,无付费,无限流
  • 🚶 真实路线:OSRM 步行导航,不穿墙不穿海
  • 🖥️ 全屏适配:横向全屏布局,电脑手机都完美
  • 🎨 主题色:一行命令切换任意主题色(国家/城市/品牌色)
  • 📊 详细数据:总距离、步行时长、游览时长、站点列表
  • 零依赖:Python 内置库 + curl,无需 pip install

使用 | Usage

python3 skills/citywalk-map/scripts/generate.py "路线标题" "lat1,lon1,name1,desc1|lat2,lon2,name2,desc2|..."

示例 | Examples

巴黎 | Paris

COLOR=#0055A4 python3 skills/citywalk-map/scripts/generate.py \
  "巴黎卢浮宫Citywalk" \
  "48.8606,2.3376,卢浮宫|48.8641,2.3276,杜乐丽花园|48.8656,2.3211,协和广场|48.8637,2.3130,亚历山大三世桥|48.8738,2.2950,凯旋门|48.8595,2.3122,荣军院|48.8584,2.2945,埃菲尔铁塔"

海口 | Haikou

python3 skills/citywalk-map/scripts/generate.py \
  "海口万绿园 → 观海台" \
  "20.0352,110.3104,万绿园|20.0315,110.2468,观海台"

主题色 | Theme Colors

国家颜色
🇨🇳 中国#DE2910
🇫🇷 法国#0055A4
🇬🇧 英国#012169
🇯🇵 日本#BC002D
🇺🇸 美国#3C3B6E
默认#e94560

截图流程 | Screenshot

python3 -m http.server 18767 --directory /tmp &
# 等待 20 秒 → browser screenshot → 飞书发送
pkill -f "http.server 18767"

坐标获取 | Coordinates

打开 Nominatim,点击 "detail" 获取精确坐标。


输出 | Output

  • 横向全屏 HTML 地图卡片
  • OSM 真实地图底图 + OSRM 步行路线
  • 主题色虚线路径 + 景点标记
  • 统计区:总距离、步行时长、游览时长、站点数
  • 途经景点列表 + 实用贴士

文件 | Files

skills/citywalk-map/
├── SKILL.md           # 本文档
├── scripts/generate.py # 地图生成(输出 /tmp/citywalk_map.html)
├── README.md           # 中文说明
├── README.en.md       # English
├── package.json
└── LICENSE            # MIT

开源许可 | License

MIT License

Comments

Loading comments...