企查查

根据公司名称查询企业基本信息、知识产权（专利/商标/著作权），数据来源企查查、天眼查等。

Before installing or running this skill: 1) Review qichacha.js yourself (or have someone you trust do so) — it contains a hard‑coded Tavily API key; consider removing or rotating that key if you control it. 2) Be aware that running npm install will fetch dependencies and package tarballs (package-lock.json points to HTTP mirrors), which increases the risk of tampered packages — prefer running in a sandbox or verifying package integrity. 3) If you require guarantees about data handling, prefer skills that ask you to provide your own API credentials (instead of embedding a vendor key) or that call the official public sites directly. 4) If unsure, do not run npm install or run the script on an isolated machine/container and monitor outbound network traffic (api.tavily.com).

Type: OpenClaw Skill Name: qichacha Version: 1.2.1 The skill contains a hardcoded Tavily API key in `qichacha.js`, which is a significant security vulnerability (credential leak). While the script's logic is consistent with its stated purpose of querying enterprise information by using the Tavily search API to aggregate data, the inclusion of static credentials and the use of unencrypted HTTP mirrors in `package-lock.json` (mirrors.tencentyun.com) are high-risk practices.