Skills/ClawHub/amap-cli-skill

amap-cli-skill@1.0.2

VERIFIED· install only

Publisher claims: "通过 CLI 命令行参数实时操控运行在容器中的高德地图 JSAPI 2.0 实例， 支持地图状态控制、路径规划、POI 搜索等，所有操作均以结构化 JSON 输出，适合 AI Agent 驱动的地图可视化交互场景。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher lbs-amap · publishing for 211 daysInstalls 1,781Last detonated 3d ago
$clawhub install amap-cli-skill
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

LOW
Unpinned dependencySKILL.md:15 · Unpinned dependencyinstallCmd: "npm install -g @amap-lbs/amap-gui@latest"Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
HIGH
Access to sensitive file pathsSKILL.md:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst env = c?.skills?.entries?.['amap-cli-skill']?.env || {};Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Unpinned dependencySKILL.md:79 · Unpinned dependency> 如果 `amap-gui --version` 执行失败（命令不存在），必须先执行 `npm install -g @amap-lbs/amap-gui@latest` 安装后再继续。Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
HIGH
Access to sensitive file pathsSKILL.md:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst env = c?.skills?.entries?.['amap-cli-skill']?.env || {};Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Unpinned dependencySKILL.md:76 · Unpinned dependencyamap-gui --version || npm install -g @amap-lbs/amap-gui@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06

Cost to the agent

Instructions loaded
≈4,222 tok
1 file · 2 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.