shop-review-generator
ReviewAudited by ClawScan on May 10, 2026.
Overview
This skill is not malware, but it is designed to create human-looking public restaurant reviews and includes some risky API/security plumbing that users should review carefully.
Use this skill only for reviews based on your own real visit and photos. Before posting, remove any detail you did not personally observe, consider disclosing AI assistance, and be aware that shop names or links may be sent to Amap and web search providers. There is no evidence of hidden persistence or credential theft, but the bundled API key and disabled-TLS fallback should be fixed or reviewed before trusting the network results.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If posted as-is, the generated review could mislead readers, platforms, or businesses into treating AI-assisted or secondhand claims as a genuine personal dining experience.
The skill targets public review platforms and instructs the agent to make generated content read like an authentic diner review, without requiring disclosure that the review was AI-assisted or partly based on searched third-party information.
为大众点评、高德扫街榜等平台生成高质量店铺点评...生成的点评应该像一个真实食客写的
Use it only to help draft reviews for places you actually visited, disclose AI assistance where appropriate, and remove any details you did not personally observe.
Unsupported details could unfairly affect a restaurant’s reputation or cause other users to trust claims that were not actually experienced.
The self-check requires at least one imperfection such as long wait time or portion size; unless grounded in the user's actual experience, this can create fabricated positive or negative claims.
有至少一处"不完美"的描述（量少、偏咸、等太久等）
Require every experiential detail, especially complaints or praise, to be confirmed by the user before inclusion.
On an untrusted network, shop links or search terms could be intercepted or API results could be tampered with, leading to inaccurate generated reviews.
If certifi is not installed, the script intentionally disables TLS certificate verification for Amap and redirect requests.
# 没有 certifi，尝试不验证证书（开发环境可接受） _ssl_context = ssl._create_unverified_context()
Do not disable certificate verification; require a valid system trust store or certifi and fail safely if verification cannot be performed.
Queries may run under an unknown shared API key, and the exposed key could be rate-limited, revoked, or associated with someone else’s provider account.
The Amap provider credential is embedded in the script rather than supplied by the user or declared as an environment requirement.
AMAP_KEY = "e0c7d5a147d5a0b82563dabdb35e5a78"
Move the API key to a documented environment variable or configuration setting, and clearly disclose what provider receives the user’s shop queries.
The helper may create JPEG files in the same directory or chosen output directory, and may call local tools such as sips or ImageMagick.
The skill instructs the agent to run a bundled local Python helper to convert HEIC images; this is purpose-aligned and only used after direct image recognition fails.
python <skill-path>/scripts/convert_heic.py <图片路径或图片目录>
Run the conversion only on intended photo files or directories, and review where converted files will be written.