← 返回 Skills 市场
850
总下载
1
收藏
8
当前安装
1
版本数
在 OpenClaw 中安装
/install map-search
功能描述
更适合中国体质宝宝的地图搜索工具，支持高德、百度、腾讯地图聚合搜索。
安全使用建议
This skill's code matches its description: it queries official Amap/Baidu/Tencent APIs and falls back to env vars or ~/.config/openclaw/map_config.json for API keys. Before installing:
- Confirm the author/source (owner is unknown). Unknown-source skills carry higher risk.
- Note that the registry metadata omitted required API keys and the config path; you should treat the config file (~/.config/openclaw/map_config.json) as sensitive because it will contain your provider API keys.
- If you don't want a system-wide CLI, avoid creating the /usr/local/bin symlink (that requires root). Run the script from a user-controlled path instead.
- The script uses Amap IP geolocation when coords are not supplied — this will send your IP to Amap if you rely on that feature.
- Install 'requests' in a virtualenv or container first and review the map_search.py file yourself if you can. If you decide not to trust the unknown owner, run in an isolated environment or do not provide real API keys.
功能分析
Type: OpenClaw Skill
Name: map-search
Version: 1.0.0
The skill's core functionality is benign, providing a multi-map search tool. However, the `map_search.py` script contains a URL injection vulnerability. User-supplied inputs such as `keyword`, `region`, `lat`, `lng`, and `radius` are directly interpolated into API request URLs using f-strings without proper URL encoding. This allows an attacker to inject arbitrary URL parameters into the map API calls if they can control the input arguments passed to the script, potentially manipulating the API request or causing unexpected behavior. This is a vulnerability, not intentional malice.
能力评估
Purpose & Capability
The code and SKILL.md implement map search across Amap, Baidu, and Tencent and require Python and the requests library — that fits the stated purpose. However, the registry metadata at the top of the submission claims no required environment variables and no config paths, while both SKILL.md and map_search.py clearly require API keys (AMAP_API_KEY, BAIDU_MAP_API_KEY, TENCENT_MAP_API_KEY) and read a configuration file at ~/.config/openclaw/map_config.json. That mismatch is an incoherence worth flagging.
Instruction Scope
Runtime instructions are focused on keyword and nearby searches and only reference map APIs. The code reads ~/.config/openclaw/map_config.json (and falls back to env vars) and will call the official map provider endpoints. The nearby-location feature uses Amap's IP geolocation when no coordinates are provided, which sends your IP to Amap. Instructions suggest creating a system symlink (/usr/local/bin) and show examples using /root/.openclaw paths — these are normal for a CLI but require appropriate privileges and care.
Install Mechanism
There is no install spec and no remote downloads; this is an instruction-only skill with a locally included Python script. The only extra dependency is the 'requests' Python package (SKILL.md notes to pip install requests). No archive downloads or third-party installers were observed.
Credentials
Requesting API keys for Amap, Baidu, and Tencent is proportionate to an aggregator map tool. However, the submission's top-level metadata did not list these required environment variables while SKILL.md and the code do — this discrepancy could lead to silent failures or misconfiguration and should be clarified. The skill also reads a config file in the user's home directory (~/.config/openclaw/map_config.json) which was not declared in registry metadata.
Persistence & Privilege
The skill does not request elevated platform privileges (always is false) and does not modify other skills. The only persistence suggestion is an optional symlink into /usr/local/bin (requires admin privileges to create) to expose the script as a system CLI. No evidence of self-enabling, system-wide config modifications, or hidden background services was found.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install map-search - 安装完成后，直接呼叫该 Skill 的名称或使用
/map-search触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- 首发版本：聚合高德、百度、腾讯地图，支持关键词及附近搜索。
- 支持通过配置文件或环境变量设置各平台 API Key 与搜索优先级。
- 提供命令行使用方式及参数，支持经纬度、半径、自定义关键词等灵活搜索。
- 新增附近搜索模式，可根据当前位置或指定坐标查找周边地点。
- 输出格式清晰，适合直接终端阅读。
元数据
常见问题
Map Search 是什么？
更适合中国体质宝宝的地图搜索工具，支持高德、百度、腾讯地图聚合搜索。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 850 次。
如何安装 Map Search？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install map-search」即可一键安装，无需额外配置。
Map Search 是免费的吗？
是的，Map Search 完全免费（开源免费），可自由下载、安装和使用。
Map Search 支持哪些平台？
Map Search 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Map Search？
由 收藏夹1区（@shoucangjia1qu）开发并维护，当前版本 v1.0.0。
推荐 Skills