错敏信息检测

通过调用UCAP安全接口，检测文本或网页内容中的多种敏感信息，支持智能静态和动态抓取模式，保障数据合规。

This skill appears coherent and security-conscious. Before installing: 1) Review where the UCAP API endpoint(s) are called in main.py so you know what external host(s) receive data. 2) Use an isolated Python environment (venv) when pip installing the listed dependencies. 3) Do NOT enable dynamic/browser mode (DISABLE_JAVASCRIPT=False) unless you intentionally install Node/agent-browser/Chrome and you set a strict ALLOWED_DOMAINS whitelist — dynamic mode executes page JS and can create SSRF risks if misconfigured. 4) Treat the UCAP userKey like any API key: provide it only if you trust the UCAP service; the code stores it only in-process but suggests persisting as a system env var for convenience (avoid persisting secrets unless necessary). If you want extra assurance, request the maintainer to publish the UCAP API endpoint and any telemetry behavior in the code for review.

Type: OpenClaw Skill Name: ucap-sensitive-check Version: 1.0.1 The skill is designed for sensitive information detection using the UCAP platform and demonstrates a high level of security awareness. It implements robust SSRF protections in `main.py`, including DNS resolution-based IP filtering, private/reserved network blocking, and secondary validation after URL redirects. While it utilizes `subprocess.run` to interface with an external `agent-browser` tool for dynamic content, it does so using safe argument lists and requires an explicit domain whitelist. The handling of the `userKey` via environment variables is standard for API integration, and no evidence of malicious intent, data exfiltration, or prompt injection was found.