📦 Citywalk Map — 步行地图生成
v2.0.7基于OpenStreetMap与OSRM，一键生成可自定义主题色、全屏自适应的Citywalk步行路线HTML地图，并输出详细步行数据与站点信息。
0· 120·1 当前·1 累计
by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to consider before installing/using:
- Functional correctness: generate.py is the primary script and should work with curl and Python 3. render.py requires third-party Python packages (requests, Pillow). If you don't want to install extra packages, avoid running render.py.
- Dependency claim mismatch: the docs claim 'zero dependencies' but render.py contradicts that. Verify and install only what you trust (pip install requests Pillow) in an isolated environment if needed.
- Network activity...详细分析 ▾
ℹ 用途与能力
The name/description (generate OSM+OSRM walking-route HTML with theme and screenshots) matches the code: generate.py builds routes using OSRM and Nominatim and writes /tmp/citywalk_map.html. However there are mismatches: SKILL.md and some docs claim 'zero dependencies' (Python stdlib + curl) while scripts/render.py requires third-party packages (requests, Pillow). README.md mentions an automatic Gaode (Amap) tile fallback for China but the code uses openstreetmap.fr tiles and does not implement the claimed automatic switch. package.json version (3.1.0) and repository metadata also differ from registry metadata (2.0.7). These inconsistencies look like sloppy packaging rather than outright malicious intent, but they are unexplained.
ℹ 指令范围
Runtime instructions direct the agent/user to run scripts/generate.py (expected). The tool performs multiple network calls (router.project-osrm.org, nominatim.openstreetmap.org, wttr.in, OSM tile servers) which are necessary for routing/tiles/weather. The SKILL.md instructs starting a local Python http.server and later uses pkill -f to stop it; pkill may terminate other matching processes on the host if used carelessly. The code does not read arbitrary system files or request unrelated credentials.
ℹ 安装机制
No install spec is provided (instruction-only), which is low-risk, but the bundle includes executable scripts. render.py has non-standard dependencies (requests and Pillow) that are not installed automatically and contradict the 'zero dependencies' claim — if a user tries to run render.py without installing these libs it will fail. No external archives or obscure download URLs are used in the bundle itself.
✓ 凭证需求
The skill requests no credentials or sensitive environment variables. An optional COLOR env var controls theme color; otherwise it does not require secrets. The code copies the environment when launching subprocesses but does not exfiltrate env vars. Network access is used for public mapping/weather services only.
✓ 持久化与权限
The skill does not request persistent or elevated privileges. always is false. It writes output to /tmp and suggests running a local http.server; it does not modify other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.72026/3/20
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install citywalk-map
镜像加速npx clawhub@latest install citywalk-map --registry https://cn.longxiaskill.com