Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Amap Poi Fetch

v1.0.0

高德地图POI数据采集技能。通过关键词抓取城市的医疗美容和生活美容机构分布数据,输出JSON原始数据和Excel汇总文件。触发词:「采集XX城市医美数据」「抓取POI」「导出医美机构Excel」「XX市医美机构分布」。

0· 32·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, SKILL.md, and the included Python script are consistent: the script queries Amap POI and district APIs, saves JSON to ~/.openclaw/workspace/data/<city>_poi, and can export Excel. No unrelated services, binaries, or config paths are requested.
Instruction Scope
SKILL.md describes how to run the script and where outputs are stored; the runtime instructions stay within the stated scraping/export scope. Minor mismatch: the SKILL.md documents --key and a default owner KEY, while the script also respects an AMAP_KEY environment variable (SKILL.md doesn't mention AMAP_KEY).
Install Mechanism
Instruction-only skill with no install spec and a single Python script. Only runtime dependency is openpyxl (pip), which is declared. No network downloads or archive installs by the installer.
!
Credentials
The script embeds a hard-coded DEFAULT_KEY (0c166a2bf61c1e4e6c96e3b645233e54) that the SKILL.md calls the "owner's key" and will be used unless the user supplies --key or sets AMAP_KEY. Shipping a private API key in the code is disproportionate: it causes requests to be attributed to the owner (quota/billing/usage visibility), allows the owner to monitor usage patterns tied to this key, and could get the key rate-limited or revoked. The skill does not require any unrelated credentials, but the embedded key is a notable risk.
Persistence & Privilege
always is false and the skill does not modify other skills or system-wide settings. It only writes its own output files under the user workspace (~/.openclaw/workspace/data). No elevated persistence or privileges requested.
What to consider before installing
This skill appears to do what it says (Amap POI scraping + Excel export), but it includes a hard-coded Amap API key that will be used by default. Before installing/running: (1) consider supplying your own Amap key with --key or by setting AMAP_KEY in your environment instead of using the embedded key; (2) inspect or remove the DEFAULT_KEY from the script to avoid attributing your queries to the skill owner; (3) be aware of Amap terms of service and rate limits — heavy scraping may violate terms or exhaust quotas; (4) review where files are written (~/.openclaw/workspace/data/) and ensure you’re comfortable with local storage of scraped data; (5) if you need higher assurance, run the script in an isolated environment and/or modify it to remove the hard-coded key and to explicitly document accepted env vars.

Like a lobster shell, security has layers — review code before you run it.

latestvk975x9kp9rx0w16cpnegm0dgz185acnx
32downloads
0stars
1versions
Updated 17h ago
v1.0.0
MIT-0

amap-poi-fetch · 高德POI医美机构采集

快速使用

# 基本用法
python3 scripts/poi_fetch.py <城市名>

# 示例:采集成都数据
python3 scripts/poi_fetch.py 成都

# 跳过Excel(只采集JSON)
python3 scripts/poi_fetch.py 上海 --skip-excel

# 指定KEY
python3 scripts/poi_fetch.py 深圳 --key <YOUR_KEY>

工作流程

城市名输入
  ↓
获取城市区划adcode(高德行政区划API)
  ↓
逐区采集:
  ① 医疗美容 → ② 生活美容
  每词翻页(每页20条,上限200条)
  ↓
保存JSON到 ~/.openclaw/workspace/data/<城市>_poi/
  ↓
生成Excel(含3个Sheet:汇总 + 医疗美容明细 + 生活美容明细)

输出文件

文件类型位置
JSON原始数据~/.openclaw/workspace/data/<城市>_poi/*.json
Excel汇总~/.openclaw/workspace/data/<城市>_poi/<城市>医美生活美容数据_YYYYMMDD.xlsx

Excel结构

  • 汇总:各区医疗美容/生活美容数量统计
  • 医疗美容明细:机构名称、电话、地址、评分、人均、商圈、坐标
  • 生活美容明细:同上字段

已知限制

限制说明
API硬上限每词每区最多返回200条
QPS限制并发需间隔≥1秒
KEY默认使用主人已申请的KEY(0c166a2bf61c1e4e6c96e3b645233e54

脚本参数

参数说明
<城市名>必填,城市/省份名称(支持"成都""成都市")
--skip-excel仅采集JSON,不生成Excel
--key <KEY>使用指定高德KEY

依赖

pip install openpyxl

执行路径

脚本位置:~/.openclaw/workspace/skills/amap-poi-fetch/scripts/poi_fetch.py

Comments

Loading comments...