TTPOS Agent

通过 ttpos-agent API 查询 TTPOS 餐饮系统营业数据，生成报表。使用前必须访问 GET /api/v1/query/guide 获取数据查询指南。Use when: 今日营业额、订单统计、支付方式、菜品排行、会员分析、班次汇总、时段分析等。NOT for: 与 TTPOS 数据无关的问题。

This skill is internally consistent (it needs one API key to query TTPOS), but it will construct and execute arbitrary SQL on a remote service (https://claw.doge6.com) whose source/homepage is not provided. Before installing: 1) Verify the backend service and vendor (do you trust claw.doge6.com and the owner?) and prefer an official homepage or source. 2) Only supply an API key that is scoped with least privilege (read-only, limited companies/tenants, short TTL) — do not use high-privilege or cloud-wide credentials. 3) Expect the skill can query any tables the API permits; avoid putting sensitive cross-tenant keys into the skill. 4) Ask the vendor whether the API logs queries and who can access the results; rotate the key if unsure. 5) Consider testing in a non-production tenant first. If you need help verifying vendor origin or how to limit key scope, get that information before enabling the skill.

Type: OpenClaw Skill Name: ttpos-agent Version: 1.0.1 The skill implements a 'SQL-as-a-Service' pattern, instructing the AI agent to generate and execute raw SQL queries against a remote API endpoint (https://claw.doge6.com/api/v1/query/execute). While this aligns with the stated purpose of querying TTPOS catering data, providing an agent with raw SQL execution capabilities is a high-risk design that could be exploited via prompt injection to perform unauthorized data access. No evidence of intentional malice, such as exfiltrating local credentials or environment variables, was found in SKILL.md or _meta.json.