技能详情（站内镜像，无评论）
作者：TR @14-TR
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.3
统计：⭐ 0 · 512 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：14-tr/gitmap
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's functionality (Git-like ops for ArcGIS) is coherent, but there are multiple security and metadata inconsistencies you should understand before installing (exposed local HTTP API with permissive CORS, insecure handling of passwords via CLI flags/process args, and a mismatch between declared and required environment variables).
目的
The name, description, and code match: this is a thin wrapper around a gitmap CLI / gitmap_core library to manage ArcGIS web maps. Requesting ArcGIS portal credentials and a working-directory makes sense for this purpose. However, the registry metadata claims no required environment variables while SKILL.md and the code clearly expect PORTAL_URL, ARCGIS_USERNAME and ARCGIS_PASSWORD (or tokens) — that's an inconsistency between declared metadat…
说明范围
SKILL.md instructs the agent/user to set portal credentials and to install gitmap-core — expected. But the skill runs a local HTTP server (server.py) exposing endpoints that will call tool functions and it sets Access-Control-Allow-Origin: '*' (CORS wildcard). That combination allows any web page the user visits (or an attacker controlling a local browser context) to make cross-origin requests to the local server and trigger tool actions that …
安装机制
There is no install spec in the registry (instruction-only), and the SKILL.md asks users to pip install gitmap-core. No third-party download URLs or archive extraction are used by the skill files themselves. The install requirement (pip install gitmap-core) is expected for a Python wrapper, but you should verify the origin and trustworthiness of the gitmap-core package before installing.
证书
The skill requires portal credentials to function, which is reasonable for ArcGIS access — but the code passes passwords via CLI flags (--password) when calling the gitmap CLI. Command-line arguments can be visible to other local users via process listings and to tooling that captures process args, so passing secrets this way is insecure. Additionally, the subprocess invocations copy the entire os.environ into the child, potentially exposing u…
持久
The skill is not marked always:true, does not modify other skills, and only runs a local HTTP server bound to localhost. It does not request system-wide persistence beyond running a process when executed. The server prints logs to stdout but does not alter system or agent config files.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Git-Map」。简介：Provides Git-like version control tools for ArcGIS web maps, enabling branch ma…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/14-tr/gitmap/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。