📦

yelp

Name: yelp
Author: fetcher-sh

內容修訂 r1 中風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

Search Yelp Businesses and Reviews

Local business research requires searching listings and gathering details and reviews. This skill documents paid fetcher.sh requests for these tasks through HTTP and MCP.

支援: Claude Codex Code(CC)

📊 69 尚可

Maintain this Skill? Claim it 📊 69 尚可

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "yelp" from https://skillstore.io/skills/fetcher-sh-yelp.md and its manifest at https://skillstore.io/api/skills/fetcher-sh-yelp/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/fetcher-sh-yelp.md 已簽名 manifest GET /api/skills/fetcher-sh-yelp/manifest 已簽名 lockfile GET /api/skills/fetcher-sh-yelp/lockfile

測試它

正在使用「yelp」。 Explain the request for ramen businesses in San Francisco sorted by rating.

預期結果:

Search: ramen in San Francisco.
Sorting: rating.
Endpoint: business search.
Documented cost: $0.003 for one call.
Payment approval is required before execution.

正在使用「yelp」。 Explain how to retrieve a business's second review page.

預期結果:

Use the business ID with the reviews endpoint.
Set the page parameter to 2.
Authenticate with prepaid credits or an approved x402 payment setup.
Stop after payment errors; upstream failures may still incur charges.

正在使用「yelp」。 Which documented MCP tools are free or paid?

預期結果:

Free: search_endpoints, describe_endpoint, and check_balance.
Paid: fetch_data, topup_credits, and yelp_search.
Confirm spending and credit topups before invoking paid tools.

安全審計

中風險

v1 • 2026/9/30 開啟版本化報告

All 57 static findings are false positives involving Markdown, reference links, documented API calls, placeholders, or expected service authentication. No evidence found of malware, credential theft, or prompt injection in the reviewed file. A separate payment-safety finding concerns automatic signing without documented spending limits and nonrefundable upstream failures.

已掃描檔案

138

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

SKILL.md:43-45 SKILL.md:116-119 SKILL.md:128-129

Automatic payments lack documented spending safeguards

The guide says payment signing and retries are automatic and exposes paid MCP tools without spending limits or confirmation requirements. Nonrefundable upstream failures can amplify losses from repeated agent calls.

Automatic signing, paid tools, and nonrefundable settlement are explicit; this file supplies no consent or budget controls. External implementations may impose safeguards, but were not reviewed.

風險因素

⚙️ 外部命令 (30)

🌐 網路存取 (13)

SKILL.md:29 SKILL.md:37 SKILL.md:41 SKILL.md:72 SKILL.md:82 SKILL.md:89 SKILL.md:92 SKILL.md:100 SKILL.md:109 SKILL.md:133 SKILL.md:134 SKILL.md:135 SKILL.md:137

📁 檔案系統存取 (3)

SKILL.md:34 SKILL.md:119 SKILL.md:136

🔑 環境變數 (7)

SKILL.md:39 SKILL.md:40 SKILL.md:68 SKILL.md:78 SKILL.md:88 SKILL.md:91 SKILL.md:98

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/fetcher-sh-yelp/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/fetcher-sh-yelp/security.svg)](https://skillstore.io/skills/fetcher-sh-yelp?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/fetcher-sh-yelp?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/fetcher-sh-yelp/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/fetcher-sh-yelp.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

fetcher-sh. (2026). yelp security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/fetcher-sh-yelp/audits/1

BibTeX 引用

@techreport{fetcher-sh-fetcher-sh-yelp-2026,
  author = {fetcher-sh},
  title = {yelp security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/fetcher-sh-yelp/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "yelp security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "fetcher-sh"
date-released: "2026-09-30"
url: "https://skillstore.io/skills/fetcher-sh-yelp/audits/1"
identifiers:
  - type: other
    value: "skillstore:fetcher-sh-yelp:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Compare dining options

Search restaurants in a destination and compare returned results by rating or review count.

Research local competitors

Find nearby businesses and retrieve their details and review pages for manual comparison.

Connect a research assistant

Configure the remote MCP service and use its documented tools within an approved request budget.

試試這些提示

Search a location

Find ramen businesses in San Francisco using fetcher.sh. Confirm the payment method and one-call cost before making the request.

Compare search sorting

Search tacos in Austin by rating, then by review count. Ask approval for two paid calls and compare only returned results.

Retrieve details and reviews

Retrieve details and review page two for Yelp handle gary-danko-san-francisco. Confirm a two-call budget and stop on payment errors.

Plan an MCP workflow

Plan a Yelp MCP workflow for competitor research. Separate free discovery from paid retrieval, protect credentials, and require approval for spending and topups.

最佳實務

Verify current pricing and authorize a request budget before paid calls or credit topups.
Keep service keys outside prompts and shared configuration; send them only to the intended provider.
Use explicit locations, supported sort values, and limited pagination; stop after paid failures.

避免

Allowing automatic paid retries or credit topups without spending approval.
Placing live Bearer keys in shared files, chat messages, or logs.
Treating returned reviews as complete, current, or statistically representative without verification.

常見問題

Is this the official Yelp Fusion API?

No. It documents a third-party fetcher.sh service for Yelp business data, not a direct Yelp Fusion integration.

How are requests paid?

The guide supports prepaid credits with a Bearer key or per-call USDC payments through x402.

What does a request cost?

The guide lists $0.003 per call for its four data endpoints. Verify current prices before approving requests.

Can I sort and paginate results?

Search supports recommendation, rating, and review-count sorting plus pagination. Review retrieval also supports a page parameter.

Can Claude, Codex, and Claude Code use this skill?

The skill provides HTTP instructions and remote MCP configuration. Execution depends on the client's tools, connectivity, credentials, and payment setup.

Are failed requests refunded?

The guide states that upstream failures are nonrefundable because settlement precedes delivery. Approve budgets and avoid uncontrolled retries.

開發者詳細資訊

作者

fetcher-sh

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/fetcher-sh/fetcher-skills/tree/d7e88be6e1210bae14803dcb435e19d36cf8a17c/skills/yelp

引用

d47538c68dbdc71b7d5879e2b0a19d3608869cea

維護新鮮度

2026/9/30

使用量

0 次下載 · 0 次瀏覽

檔案結構

📄 SKILL.md