by 安全扫描
OpenClaw
安全
high confidenceThe skill's code and instructions match its stated purpose (producing city-level reference coffee prices); it makes an optional external IP lookup and requires the requests package but otherwise asks for no credentials or broad system access.
评估建议
This skill appears to be what it says: a local Python script that returns city-level reference prices. Before running: (1) review the BASE_PRICES and CITY_TIERS in scripts/coffee_prices.py if you need different values; (2) be aware the script may call https://ipinfo.io/json to auto-detect city when no --city or OPENCLAW_CITY is provided (network access required); (3) installing dependencies will pull the requests package from PyPI—run installs in a virtualenv or sandbox if you prefer; (4) the OP...详细分析 ▾
✓ 用途与能力
Name/description align with included code and SKILL.md. The script computes reference prices from embedded BASE_PRICES and CITY_TIERS and formats output as markdown/json/csv as advertised. Use of the requests library and an optional IP geolocation lookup is coherent with the advertised 'auto-detect city' feature.
ℹ 指令范围
SKILL.md and the CLI instruct the agent to optionally infer city from IP via https://ipinfo.io/json and to read an optional environment variable OPENCLAW_CITY. The instructions do not access unrelated system files or credentials. Note: OPENCLAW_CITY is used if present but not declared as a required env var (it's optional).
ℹ 安装机制
No registry install spec; this is effectively an instruction-only skill with provided Python scripts and a requirements.txt listing requests>=2.31.0. Installing dependencies via pip will fetch from PyPI (expected). No downloads from untrusted URLs or archives are present.
ℹ 凭证需求
The skill does not require credentials or secret environment variables. It does optionally read OPENCLAW_CITY and performs an outbound HTTPS request for IP-based geolocation. The optional env var is reasonable for the feature, but the registry metadata lists no environment variables while the runtime supports one optional variable.
✓ 持久化与权限
No elevated persistence requested (always:false). The skill does not modify other skills or system settings and has no install-time hooks in the registry metadata.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/5
coffee-prices v1.0.0 - Initial release with support for fetching and comparing latte, americano, cappuccino, and mocha prices from Starbucks, Luckin, and Cotti in major Chinese cities. - Provides reference prices by city tier (tier1/tier2/tier3), reflecting common local pricing. - Supports output in Markdown table (default), JSON, and CSV formats. - Allows manual city input, or automatic city detection via IP if not specified. - Extensible to add more brands and drink types with simple script edits.
● 无害
安装命令
点击复制官方npx clawhub@latest install coffee-prices
镜像加速npx clawhub@latest install coffee-prices --registry https://cn.longxiaskill.com