Amap Navigation

PendingStatic analysis audit pending.

Overview

No static analysis result has been recorded yet. Pattern checks will appear here once the artifact has been analyzed.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

You must provide an Amap API key for real use, and that key will be used when making map API requests.

Why it was flagged

The skill documentation requires a provider API key, while the registry metadata lists no required env vars or primary credential.

Skill content
AMAP_API_KEY=your_api_key_here
Recommendation

Use a dedicated Amap Web Service key with provider-side restrictions where possible, and avoid sharing the key outside your local environment.

What this means

Your entered addresses or coordinates may be sent to Amap or to whatever AMAP_BASE_URL is configured.

Why it was flagged

The route-planning script sends the API key and user-provided origin/destination data to the configured Amap API endpoint, which is expected for navigation but worth user awareness.

Skill content
url.searchParams.set('key', AMAP_API_KEY); url.searchParams.set('origin', originLoc); url.searchParams.set('destination', destLoc);
Recommendation

Only use this skill for locations you are comfortable sending to the map provider, and keep AMAP_BASE_URL set to the official Amap endpoint unless you intentionally use a trusted proxy.