tencentmap-lbs-skill
v1.0.0腾讯地图位置服务，支持POI搜索、路径规划、旅游规划、周边搜索，轨迹数据可视化和地图数据可视化
⭐ 0· 111·1 current·1 all-time
by腾讯开源@tencent-adm
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Tencent LBS: POI, routing, travel, trail visualization) match the required binary (tmap-lbs) and the single required env var (TMAP_WEBSERVICE_KEY). The declared primary credential is the expected Tencent Web Service Key.
Instruction Scope
SKILL.md restricts actions to running the tmap-lbs CLI and following scenario-specific reference docs. It instructs checking/setting the Web Service Key and to request user-provided data URLs for trail visualizations. No instructions appear to read unrelated system files or exfiltrate data beyond calling Tencent map endpoints or user-provided data URLs.
Install Mechanism
Install uses an npm package (@tencent-map/lbs-skills) producing the tmap-lbs binary — this is an expected delivery method for a CLI but carries the usual moderate risk of installing third-party npm packages (verify package authenticity, publisher, and contents before global install).
Credentials
Only one credential (TMAP_WEBSERVICE_KEY) is requested, which is proportionate to calling Tencent Web Service APIs. The docs instruct not to output the key and to prompt the user to set it if missing.
Persistence & Privilege
Skill is not always-enabled and does not request elevated/persistent platform privileges. It can be invoked autonomously by the agent (default), which is normal; there is no evidence it modifies other skills or global agent settings.
Assessment
This skill appears internally consistent: it uses the tmap-lbs CLI installed from the npm package @tencent-map/lbs-skills and your Tencent Web Service key to call map APIs. Before installing or enabling it, consider: 1) Verify the npm package and publisher (review the package on the npm registry or GitHub) before a global install; 2) Install in an isolated environment or use a non-global install if you prefer; 3) Limit the TMAP_WEBSERVICE_KEY scope and rotate it if possible — treat it like any API secret and do not paste it into chats; 4) Be cautious when supplying data URLs for trail visualization (ensure they point to benign JSON and not internal endpoints or sensitive resources); 5) Monitor API usage on your Tencent account after enabling the skill to detect unexpected calls. If you want higher assurance, review the source of @tencent-map/lbs-skills or prefer calling Tencent Web Service APIs directly with your own vetted code.Like a lobster shell, security has layers — review code before you run it.
latestvk97d8mgh56kpv2vsjnvvwrheg983khd3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binstmap-lbs
EnvTMAP_WEBSERVICE_KEY
Primary envTMAP_WEBSERVICE_KEY
Install
Install tmap-lbs (node)
Bins: tmap-lbs
npm i -g @tencent-map/lbs-skills