📦 GEO Tracker — AI搜索品牌监测
v1.0.0一键追踪品牌在 ChatGPT、Perplexity、Gemini、Google AI Overview、Claude 等 AI 搜索引擎中的曝光与排名，智能优化可见度，及时捕捉品牌提及与竞争动态，助力营销决策。
0· 461·0 当前·0 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill's scripts do what the description says, but the registry metadata fails to list the API keys the code actually requires — treat that as a red flag. Before installing: (1) view and review the included scripts (you already have them) and verify you understand the network calls; (2) do not provide production API keys immediately — test with limited-privilege or dummy keys and run in an isolated virtual environment; (3) be aware that supplying provider keys lets the tool make API calls th...详细分析 ▾
⚠ 用途与能力
The skill claims to track brand visibility across multiple AI engines and the included Python scripts implement exactly that (OpenAI, Perplexity, Google Generative AI, Anthropic). However, the registry metadata lists no required environment variables or primary credential despite the SKILL.md and code requiring multiple API keys (OPENAI_API_KEY, PERPLEXITY_API_KEY, GOOGLE_API_KEY, ANTHROPIC_API_KEY). That metadata omission is incoherent and should be corrected; otherwise the skill's manifest understates what it needs.
ℹ 指令范围
SKILL.md gives concrete instructions to run the provided scripts, set API keys, and schedule audits. The runtime instructions do not request unrelated filesystem reads or other credentials beyond the provider API keys. One minor inconsistency: SKILL.md mentions a 'Google AI Overview' web_search tool, but the code implements only API calls (no explicit web scraping/web_search implementation for a separate 'Google AI Overview').
✓ 安装机制
This is instruction-only with Python scripts and a standard pip dependency list (openai, anthropic, google-generativeai). There is no download-from-URL or archive extraction; installing Python packages via pip is expected for this use case.
⚠ 凭证需求
The skill legitimately needs API keys for each engine it queries, so multiple secret-like env vars are reasonable. The problem is the published registry metadata declares no required env vars while SKILL.md and the code expect several sensitive keys. This mismatch could mislead users into installing without preparing credentials. Also, supplying provider API keys gives the code the ability to query those services (and incur billing), so users should use limited-scope or test keys where possible.
✓ 持久化与权限
The skill does not request 'always: true', does not modify other skills or system-wide configuration, and only writes a report file when the user requests an output path. It uses normal agent invocation semantics and does not demand elevated or persistent platform privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/27
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install geo-tracker
镜像加速npx clawhub@latest install geo-tracker --registry https://cn.longxiaskill.com