스킬 amap-lbs-skill
📦

amap-lbs-skill

v2.0.0 콘텐츠 리비전 r2 높은 위험 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수

Buscar lugares en AMap y planificar rutas

Encontrar lugares y rutas fiables en mapas chinos puede requerir varias llamadas a la API de AMap. Esta skill guía la búsqueda de POI, la planificación de rutas, la planificación de viajes y la visualización de mapas.

지원: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 나쁨

이 스킬은 팩에 포함되어 있습니다

작업에 필요한 모든 스킬을 명령 하나로 설치하려면 전체 팩을 설치하세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청
Review the Skillstore skill "amap-lbs-skill" from https://skillstore.io/skills/amap-web-amap-lbs-skill.md and its manifest at https://skillstore.io/api/skills/amap-web-amap-lbs-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

테스트해 보기

"amap-lbs-skill" 사용 중입니다. Busca museos en Beijing.

예상 결과:

Un enlace de búsqueda de AMap con una nota breve indicando que el usuario puede abrirlo para ver los resultados en el mapa.

"amap-lbs-skill" 사용 중입니다. Planifica una ruta a pie entre dos coordenadas.

예상 결과:

Modo de ruta, distancia estimada, tiempo estimado y un enlace de visualización de AMap cuando los datos estén disponibles.

"amap-lbs-skill" 사용 중입니다. Crea una ruta de comida y té en Hangzhou.

예상 결과:

Una lista de POI sugeridos agrupados por interés, seguida de un resumen sencillo de la ruta.

보안 감사

높은 위험
v5 • 2026. 7. 23. 버전별 보고서 열기

Most high and medium static alerts are false positives caused by JavaScript templates, Markdown backticks, Chinese text entropy, or fixed configuration paths. Confirmed risks include outbound AMap requests, plaintext key persistence, credential exposure, mandatory telemetry, and insecure HTTP heatmap links. No prompt injection or obfuscated executable payload was found.

7
스캔된 파일
1,212
분석된 줄 수
17
검토 항목
0
오탐 무시됨

확인된 보안 우려 사항 (3)

높음
User Input Interpolated Into a Shell Command
The documented curl command inserts a user-supplied location and API key into a double-quoted shell string. Shell substitutions can execute if input is not safely encoded.
The instructions define placeholders from user input and place them directly inside a bash curl command without shell-safe argument construction.
높음
API Key Requested in Chat and Exposed on Command Line
The workflow tells the agent to ask users for an API key, then embeds it in a curl URL. This can expose credentials in chat, history, logs, and process listings.
The cited instructions explicitly request the key from the user and include the key placeholder in the command URL.
중간
Automatic Usage Telemetry Without Consent
The skill directs agents to call the AMap logging endpoint before six workflows. These mandatory requests reveal skill usage and workflow labels without user consent.
Each cited workflow explicitly says to send an analytics request before performing the requested operation.
기능 검토 항목 (17)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음
Hardcoded URL
https://restapi.amap.com/v3/geocode/geo?address={位置}&output=JSON&key={用户的key}&appname=amap-lbs-skill
The template puts the user API key in an HTTPS query string. The curl form also exposes it on a shell command line and potentially in history or process listings.
높음
Hardcoded URL
curl -s "https://restapi.amap.com/v3/geocode/geo?address={位置}&output=JSON&key={用户的key}&appname=amap-
The template puts the user API key in an HTTPS query string. The curl form also exposes it on a shell command line and potentially in history or process listings.
중간
Node.js fs operations
fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), 'utf8');
This writes configuration containing the AMap API key to plaintext config.json without setting restrictive file permissions. Other local users may be able to read the credential.
중간
Hardcoded URL
curl -s "https://restapi.amap.com/v3/log/init?eventId=skill.call&product=skill_openclaw&platform=JS&
The instructions require a curl request to the AMap logging endpoint before the user operation. This creates automatic usage telemetry without an opt-in step.
중간
Hardcoded URL
curl -s "https://restapi.amap.com/v3/log/init?eventId=skill.call&product=skill_openclaw&platform=JS&
The instructions require a curl request to the AMap logging endpoint before the user operation. This creates automatic usage telemetry without an opt-in step.
중간
Hardcoded URL
http://a.amap.com/jsapi_demo_show/static/openclaw/heatmap.html?mapStyle={地图风格}&dataUrl={数据地址(URL编码)}
The generated heatmap link uses plaintext HTTP and includes the data source URL in its query. Network observers can read or alter the request.
중간
Hardcoded URL
curl -s "https://restapi.amap.com/v3/log/init?eventId=skill.call&product=skill_openclaw&platform=JS&
The instructions require a curl request to the AMap logging endpoint before the user operation. This creates automatic usage telemetry without an opt-in step.
중간
Hardcoded URL
http://a.amap.com/jsapi_demo_show/static/openclaw/heatmap.html?mapStyle=grey&dataUrl=https%3A%2F%2Fa
The generated heatmap link uses plaintext HTTP and includes the data source URL in its query. Network observers can read or alter the request.
중간
Hardcoded URL
http://a.amap.com/jsapi_demo_show/static/openclaw/heatmap.html?mapStyle={地图风格}&dataUrl={编码后的数据地址}
The generated heatmap link uses plaintext HTTP and includes the data source URL in its query. Network observers can read or alter the request.
중간
Hardcoded URL
curl -s "https://restapi.amap.com/v3/log/init?eventId=skill.call&product=skill_openclaw&platform=JS&
The instructions require a curl request to the AMap logging endpoint before the user operation. This creates automatic usage telemetry without an opt-in step.
중간
Hardcoded URL
curl -s "https://restapi.amap.com/v3/log/init?eventId=skill.call&product=skill_openclaw&platform=JS&
The instructions require a curl request to the AMap logging endpoint before the user operation. This creates automatic usage telemetry without an opt-in step.
중간
Hardcoded URL
curl -s "https://restapi.amap.com/v3/log/init?eventId=skill.call&product=skill_openclaw&platform=JS&
The instructions require a curl request to the AMap logging endpoint before the user operation. This creates automatic usage telemetry without an opt-in step.
낮음
HTTP client library
const response = await axios.get(url, { params: requestParams });
This line makes an outbound HTTPS request to AMap with the configured API key and search or route parameters. Expected functionality still discloses user location data to a third party.
낮음
HTTP client library
const response = await axios.get(url, { params: requestParams });
This line makes an outbound HTTPS request to AMap with the configured API key and search or route parameters. Expected functionality still discloses user location data to a third party.
낮음
HTTP client library
const response = await axios.get(url, { params: requestParams });
This line makes an outbound HTTPS request to AMap with the configured API key and search or route parameters. Expected functionality still discloses user location data to a third party.
낮음
HTTP client library
const response = await axios.get(url, { params: requestParams });
This line makes an outbound HTTPS request to AMap with the configured API key and search or route parameters. Expected functionality still discloses user location data to a third party.
낮음
HTTP client library
const response = await axios.get(url, { params: requestParams });
This line makes an outbound HTTPS request to AMap with the configured API key and search or route parameters. Expected functionality still discloses user location data to a third party.

위험 요인

⚙️ 외부 명령어 (50)
🌐 네트워크 접근 (47)
📁 파일 시스템 접근 (7)
🔑 환경 변수 (2)
감사자: codex 감사 이력 보기 →
이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기
보안 평가

보고서 링크 복사

https://skillstore.io/skills/amap-web-amap-lbs-skill/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/amap-web-amap-lbs-skill/security.svg)](https://skillstore.io/skills/amap-web-amap-lbs-skill?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/amap-web-amap-lbs-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/amap-web-amap-lbs-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/amap-web-amap-lbs-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
학술 인용 (APA · BibTeX · CFF)

APA 인용

AMap-Web. (2026). amap-lbs-skill security audit report (audit version 5) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/amap-web-amap-lbs-skill/audits/5

BibTeX 인용

@techreport{amap-web-amap-web-amap-lbs-skill-2026, author = {AMap-Web}, title = {amap-lbs-skill security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/amap-web-amap-lbs-skill/audits/5}, note = {Author version 2.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "amap-lbs-skill security audit report (audit version 5)" version: "2.0.0" type: report authors: - name: "AMap-Web" date-released: "2026-07-23" url: "https://skillstore.io/skills/amap-web-amap-lbs-skill/audits/5" identifiers: - type: other value: "skillstore:amap-web-amap-lbs-skill:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간
55
아키텍처
100
유지보수성
87
콘텐츠
68
커뮤니티
91
사양 준수

만들 수 있는 것

Soporte de búsqueda local

Encuentra restaurantes, hoteles, puntos de referencia o servicios en una ciudad seleccionada y devuelve enlaces de búsqueda de AMap.

Planificación de rutas

Compara rutas a pie, en automóvil, en bicicleta o en transporte público entre coordenadas conocidas.

Borrador de viaje

Recopila POI por interés y arma un itinerario sencillo de ciudad para revisar en el mapa.

이 프롬프트를 사용해 보세요

Encontrar un lugar
Busca en AMap cafeterías en Hangzhou y dame el enlace de búsqueda.
Buscar cerca
Encuentra hoteles a menos de 1000 metros de Shanghai Hongqiao Railway Station. Pide mi clave de AMap si es necesario.
Planificar una ruta
Planifica una ruta en automóvil de 116.397428,39.90923 a 116.427281,39.903719. Incluye distancia, tiempo y enlace de mapa.
Crear un plan de un día
Crea un plan de un día en Beijing para museos, almuerzo y parques. Usa rutas a pie cuando sea posible y resume cada parada.

모범 사례

  • Pregunta antes de enviar datos del usuario o claves de API a AMap.
  • Prefiere variables de entorno en lugar de archivos de configuración locales para las claves de API.
  • Verifica las coordenadas y los nombres de ciudades antes de llamar a las API de rutas.

피하기

  • No pegues claves de API de AMap en transcripciones de chat ni en archivos públicos.
  • No uses los pasos de telemetry curl sin el consentimiento claro del usuario.
  • No trates los enlaces de mapas generados como prueba de que una ruta es segura o accesible.

자주 묻는 질문

¿Esta skill requiere una clave de API?
Sí. La búsqueda detallada de POI, la geocodificación, las rutas y la planificación de viajes requieren una clave de API de AMap Web Service.
¿Qué proveedor de mapas usa?
Usa AMap, también conocido como Gaode Map, mediante enlaces públicos y API de Web Service.
¿Puede planificar rutas?
Sí. Admite solicitudes de rutas a pie, en automóvil, en bicicleta y en transporte público cuando se proporcionan coordenadas válidas.
¿Almacena credenciales?
Puede almacenar una clave de Web Service en config.json. Las variables de entorno son más seguras para máquinas compartidas.
¿Pueden usarla Claude, Codex o Claude Code?
Sí. Los metadatos enumeran Claude, Codex y Claude Code como herramientas compatibles.
¿Envía telemetría?
Las instrucciones de la skill incluyen solicitudes de registro de AMap. Los usuarios deben aprobar esas solicitudes antes de que se ejecuten.

개발자 세부 정보

작성자

AMap-Web

라이선스

MIT

작성자 버전

v2.0.0

Skillstore 리비전

r2

참조

89edfdc710d0846129dcee6a929477b04f08052c

유지보수 최신성

2026. 7. 26.

사용량

9 다운로드 · 63 조회

파일 구조

AMap-Web의 다른 스킬

전체 보기
전체 보기