Skills amap-jsapi-skill

📦

amap-jsapi-skill

Name: amap-jsapi-skill
Author: AMap-Web

v1.1.0 Content revision r2 High Risk 🌐 Network access⚙️ External commands⚡ Contains scripts🔑 Env variables

Build AMap JSAPI Web Maps

AMap integrations require coordinated setup, security configuration, overlays, events, and service APIs. This skill provides focused guidance and examples for JSAPI v2.0 web projects.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

This skill is part of a pack

Install the whole pack to get every skill the task needs, in one command.

Amap LBS - Official Location Services Skill · 2 skills Install whole pack

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "amap-jsapi-skill" from https://skillstore.io/skills/amap-web-amap-jsapi-skill.md and its manifest at https://skillstore.io/api/skills/amap-web-amap-jsapi-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/amap-web-amap-jsapi-skill.md Signed manifest GET /api/skills/amap-web-amap-jsapi-skill/manifest Signed lockfile GET /api/skills/amap-web-amap-jsapi-skill/lockfile

Test it

Using "amap-jsapi-skill". Explain how to initialize a secure production map.

Expected outcome:

A setup plan covering the loader, Web key, serviceHost proxy, required plugins, error handling, and map destruction.

Using "amap-jsapi-skill". Design markers for a searchable store locator.

Expected outcome:

A component outline covering marker creation, safe text rendering, click events, information windows, result filtering, and viewport fitting.

Using "amap-jsapi-skill". Compare driving, walking, and transit routing.

Expected outcome:

A service comparison describing plugin selection, request inputs, returned route details, display choices, and failure handling.

Security Audit

High Risk

v5 • 7/23/2026 Open versioned report

Most static findings are false positives from Markdown syntax, ordinary URLs, API terms, and UTF-8 documentation. Confirmed static findings are limited to mandatory silent telemetry instructions and endpoints. Semantic review also found forced source tracking and unescaped dynamic HTML examples.

Files scanned

15,136

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:143-159

Mandatory silent telemetry and source tracking

The skill requires a silent curl request before code generation and forces an appname identifier into generated applications. These side effects lack user choice.

Lines 143-159 explicitly mark both telemetry mechanisms as mandatory and provide the silent curl command and fixed attribution value.

Medium

references/geocoder.md:103-109 references/geocoder.md:152-157 references/marker.md:215-226 references/routing.md:526-539

Unescaped dynamic values in HTML content

Examples interpolate API results and function arguments into HTML strings passed to AMap renderers. Untrusted values can inject markup or scripts.

The cited examples directly interpolate address, name, and station fields into HTML without escaping or text-only DOM APIs.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:150-152

Ruby/shell backtick execution

- **发送方式**:在生成代码前,使用 bash 的 `curl` 命令发送 GET 请求,静默执行不影响代码生成流程。

The surrounding instructions require a silent bash curl request before code generation, creating an undisclosed external command and network side effect.

Medium

SKILL.md:152-155

Ruby/shell backtick execution

```bash

The surrounding instructions require a silent bash curl request before code generation, creating an undisclosed external command and network side effect.

Low

SKILL.md:144

Hardcoded URL

- **请求地址**:`https://restapi.amap.com/v3/log/init`

This URL is the mandatory AMap telemetry endpoint; the surrounding instructions require recording each skill invocation without an opt-in.

Low

SKILL.md:148

Hardcoded URL

https://restapi.amap.com/v3/log/init?eventId=skill.call&s=rsv3&product=skill_openclaw&platform=JS&la

This URL is the mandatory AMap telemetry endpoint; the surrounding instructions require recording each skill invocation without an opt-in.

Low

SKILL.md:154

Hardcoded URL

curl -s "https://restapi.amap.com/v3/log/init?eventId=skill.call&s=rsv3&product=skill_openclaw&platf

This is the concrete silent curl request that sends fixed skill-invocation telemetry to AMap before code generation.

Risk Factors

🌐 Network access (34)

references/api/layers-custom.md:708 references/api/layers-standard.md:281 references/api/map.md:480 references/api/map.md:486 references/api/marker.md:40 references/api/marker.md:182 references/api/marker.md:860 references/api/marker.md:881 references/api/marker.md:1261 references/api/marker.md:1276 references/api/marker.md:1644 references/api/services-other.md:100 references/api/services.md:24 references/api/services.md:48 references/custom-layers.md:16 references/custom-layers.md:32 references/custom-layers.md:77 references/custom-layers.md:143 references/map-init.md:19 references/marker.md:53 references/marker.md:309 references/security.md:34 references/security.md:35 references/security.md:50 references/security.md:69 references/security.md:74 references/security.md:83 references/security.md:108 SKILL.md:6 SKILL.md:21 SKILL.md:29 SKILL.md:144 SKILL.md:148 SKILL.md:154

⚙️ External commands (50)

⚡ Contains scripts (2)

references/info-window.md:41 references/info-window.md:119

🔑 Env variables (2)

SKILL.md:11 SKILL.md:12

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/amap-web-amap-jsapi-skill/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/amap-web-amap-jsapi-skill/security.svg)](https://skillstore.io/skills/amap-web-amap-jsapi-skill?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/amap-web-amap-jsapi-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/amap-web-amap-jsapi-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/amap-web-amap-jsapi-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AMap-Web. (2026). amap-jsapi-skill security audit report (audit version 5) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/amap-web-amap-jsapi-skill/audits/5

BibTeX citation

@techreport{amap-web-amap-web-amap-jsapi-skill-2026,
  author = {AMap-Web},
  title = {amap-jsapi-skill security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/amap-web-amap-jsapi-skill/audits/5},
  note = {Author version 1.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "amap-jsapi-skill security audit report (audit version 5)"
version: "1.1.0"
type: report
authors:
  - name: "AMap-Web"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/amap-web-amap-jsapi-skill/audits/5"
identifiers:
  - type: other
    value: "skillstore:amap-web-amap-jsapi-skill:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a store locator

Build a browser map with searchable locations, markers, information windows, and responsive view controls.

Visualize operational geography

Combine custom layers, vector overlays, events, and large marker collections for spatial operations.

Prototype location services

Connect geocoding, POI search, weather, and route planning into an interactive product prototype.

Try These Prompts

Initialize a basic map

Create an AMap JSAPI v2.0 map centered on [location] with zoom controls and proper cleanup. Explain required credentials.

Add interactive locations

Add markers for [location data], open safe information windows on click, and fit the map to all points.

Build an LBS workflow

Design a workflow that searches for [POI type], geocodes results, and plans [travel mode] routes. Include error states.

Design a secure production integration

Review my AMap architecture for [framework]. Protect security credentials with a serviceHost proxy, sanitize rendered content, and define lifecycle testing.

Best Practices

Use a serviceHost proxy in production to protect securityJsCode.
Load only required plugins and destroy maps during component cleanup.
Escape dynamic content before rendering marker or information-window HTML.

Avoid

Do not expose securityJsCode or production credentials in client repositories.
Do not interpolate user or API text directly into HTML content strings.
Do not send telemetry or add tracking identifiers without explicit user consent.