smart-site-selection-skill — 技能工具
v1.0.0专为实体商业选址设计，自动采集核心客群与经营策略，提取Top3优质地段坐标并生成宏观微观商业洞察报告。
0· 55·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe code and runtime instructions match the stated site‑selection purpose, but there are metadata and packaging inconsistencies (missing declared env var, mixed package.json / Python metadata, differing versions) that make the bundle suspicious and worth manual review before installing.
评估建议
What to check before installing:
- The bundle requires an AMap Web Service API key (AMAP_WEBSERVICE_KEY). Confirm you are willing to provide that key and that you trust the unknown source; the top-level registry metadata incorrectly omitted this requirement.
- The package mixes Python code with an npm-style package.json (versions differ: package.json v2.1.0 vs skill v1.0.0). This is a packaging inconsistency — ask the author or inspect the repository origin before trusting it.
- The code calls o...详细分析 ▾
⚠ 用途与能力
The skill's core purpose (select top-3 coordinates via AMap and hand off deep checks to a Python engine) is coherent with the code: main.py enforces AMAP key presence and the scripts call AMap APIs. However registry-level metadata provided above claims no required env vars while SKILL.md, package.json.openclaw.requires, and main.py all expect AMAP_WEBSERVICE_KEY. This mismatch (declared NONE vs actual requirement) is an incoherence that could cause misconfiguration or unexpected prompts for credentials.
ℹ 指令范围
SKILL.md defines a tight SOP: request core business params, ONLY fetch Top-3 coordinates in the agent layer, and delegate traffic/competitor queries to the Python engine. The code follows that flow (main.py enforces parameter collection and scripts/site_selection_engine.py performs deeper AMap queries). The SKILL.md lists dependent skills (searxng, proactive-agent) that are not invoked in the provided Python code — this is a mild scope mismatch but not clearly malicious.
ℹ 安装机制
No install spec (instruction-only at registry level) and packaged files are local — there is no external download URL or extraction step. That lowers install risk. Oddity: package.json exists and lists dependencies like 'matplotlib' and 'requests' in an npm-style file (and 'engines' lists python/node). This mix of Node-style manifest with Python runtime is inconsistent and should be reviewed, but it is not an immediate code-execution red flag by itself.
⚠ 凭证需求
The runtime needs a single external credential (AMAP_WEBSERVICE_KEY) which is proportionate to a mapping/LBS skill. The problem is the top registry block incorrectly said 'Required env vars: none' while SKILL.md, package.json and main.py require AMAP_WEBSERVICE_KEY and the code uses it directly for requests to restapi.amap.com. That metadata mismatch could mislead users into providing keys unexpectedly. No other unrelated secrets are requested.
✓ 持久化与权限
The skill does not request permanent 'always' presence and uses normal file outputs only: it writes a temporary state file to /tmp/site_selection_state.json and writes HTML reports to the current working directory. It does not modify other skills or system-wide agent settings in the provided code.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/9
smart-site-selection-skill 1.0.0 – 首个公开版本 - 支持通过关键词自动触发实体商业选址分析流程。 - 内置参数强校验，追问客户核心客群与经营战略，缺失即强制阻断。 - 自动调用高德地图，仅获取 Top 3 地段名称与经纬度坐标。 - 生成市场前景定调与三大地段优劣点评文本，避免任何自造数据。 - 清晰分工：AI 负责逻辑与文本生成，Python 后端负责数据抓取、评分与报告排版。 - 报告输出为 HTML 文件，含交互式可视化与多维评估矩阵。
● 无害
安装命令 点击复制
官方npx clawhub@latest install smart-site-selection-skill
镜像加速npx clawhub@latest install smart-site-selection-skill --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制