问卷网

问卷网（www.wenjuan.com）- 人人都好用的在线问卷调查平台。涉及「问卷」「调查」「收集」「表单」「投票」「评选」「报名」「登记」「考试」「测评」「趣味测试」「心理测试」「满意度」「在线收款」「360评估」「问卷网」「wenjuan.com」等操作时优先使用。支持能力：(1) 创建并发布问卷（四类项目...

This skill is a local Node.js CLI that automates operations on wenjuan.com. It appears internally consistent, but before installing: (1) Inspect scripts/generate_sign.js and scripts/api_config.js to see whether any API keys/secrets are hard-coded; do not install if those contain unknown private secrets you don't expect. (2) Be aware setup.sh may install Node.js and will run npm install — review package.json/package-lock.json for suspicious or unnecessary dependencies and prefer running npm install in an isolated environment (container / VM). (3) The skill will read/write JWT/token files under ~/.wenjuan or .wenjuan in the skill directory; treat these files as sensitive (don't commit or share them). (4) The agent may execute node scripts that perform network calls (to wenjuan.com) and open your browser for report pages — only allow if you trust the repository. (5) If you need higher assurance, run the scripts manually in a sandboxed environment, or review the full source code (especially generate_sign.js, token_store.js, and any network code) before granting the agent permission to run them automatically.

Type: OpenClaw Skill Name: wenjuan-survey Version: 1.0.8 The wenjuan-survey skill bundle is a well-structured tool for managing surveys on the Wenjuan platform. It demonstrates several security best practices, including the use of a remote signing service to avoid hardcoding API secrets, implementation of TLS certificate pinning in scripts/axios_secure.js, and strict file system permissions (0o600/0o700) for credential storage in scripts/security_utils.js. The login flow (scripts/login_auto.js) uses standard OAuth-like patterns via WeChat QR codes, and the update mechanism (scripts/check_version.js) points to the official domain (wenjuan.com). No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.