干饭决策助手。帮你决定今天吃什么，发现附近餐馆，一键生成餐馆 Skill。 支持 /eat 系列命令。问"吃什么"、"附近有什么吃的"、"帮我选"时触发。

This Skill appears to do what it says (help pick food, search nearby using AMap, and generate restaurant Skill files), but there are a few mismatches you should be aware of before installing: - SKILL.md and the code use an AMAP_WEBSERVICE_KEY (Gaode/AMap) for nearby search/navigation, but the registry metadata lists no required env vars. If you provide a key it will be used for network calls; if you don't, those features degrade to local-only behavior. Only provide API keys you control and review their permissions/quota. - The package contains package.json/package-lock and README instructs running 'npm install' and some scripts (node schedule/nudge.mjs, vendor scripts). Installing will fetch npm packages from the registry — inspect package-lock and vendor/amap-lbs-skill before running in a production environment. Consider installing in an isolated environment (container/VM) if you are unsure. - The Skill will read/write local files: it stores user-profile.json and can write restaurants/{slug}/SKILL.md via the generator. If you don’t want files written into your environment, avoid running generator scripts or running automated install hooks. - Scheduled reminders are described as 'auto-enabled' on install in the docs; verify what your agent/platform actually does (OpenClaw, Claude schedule, crontab examples). Don’t allow the skill to register system-wide cron jobs unless you review the commands. - If you plan to use /eat-discover or /eat-navigate, review vendor/amap-lbs-skill code (JavaScript + a Python helper is included) to confirm network behavior and to ensure it only calls the expected AMap endpoints. Recommendation: if you want this functionality, run it in a controlled environment, review package-lock and vendor code, supply only a dedicated AMAP key, and verify any scheduled task registration steps manually. The inconsistencies in declared requirements (missing AMAP env var and lack of install spec) make this skill 'suspicious' but not clearly malicious.

Type: OpenClaw Skill Name: eat-skill Version: 0.1.0 The 'eat-skill' bundle is a comprehensive meal decision assistant that integrates with Gaode Maps (AMap) for restaurant discovery and navigation. The code logic in 'generator/generate.mjs', 'schedule/nudge.mjs', and the 'vendor/amap-lbs-skill' directory is consistent with the stated purpose of managing user food preferences, generating restaurant skills, and performing LBS queries. While the skill handles sensitive API keys (AMAP_WEBSERVICE_KEY) and uses potentially risky functions like 'child_process.exec' in 'route-planning.js' to open browser links, these are used legitimately for map visualization and API interaction. No evidence of data exfiltration, persistence mechanisms, or malicious prompt injection was found.