Shuzhi Open

数秦开放平台统一接口封装，支持区块链API服务、自动化取证、保管单组件、电子签章

This skill appears to implement what it claims, but it will upload user files and personally identifying information to the configured baseUrl using the appKey/appSecret stored in config.json. Before installing or running: 1) Verify the baseUrl (domain) and that the appKey/appSecret are issued by a trusted provider; do not use production credentials against unknown endpoints. 2) Treat config.json as secret (store securely, restrict permissions). 3) Expect contract PDFs and personal ID numbers to be transmitted — only proceed if you trust the service and the legal/regulatory implications. 4) If you need higher assurance, review the omitted lib/* files (auth.js, client.js, modules/*) to confirm there is no unexpected telemetry, hard-coded remote endpoints, or secret exfiltration. 5) Run the scripts in an isolated environment and avoid running with elevated system privileges.

Type: OpenClaw Skill Name: shuzhi-open Version: 1.0.3 The shuzhi-open skill bundle is a legitimate integration for the ShuQin Open Platform, providing wrappers for blockchain存证 (blockchain evidence), automated forensics, and electronic signatures. The code implements standard HMAC-SHA256 authentication (lib/auth.js) and provides well-structured modules and CLI scripts for interacting with the platform's APIs. Notably, the SKILL.md instructions include strong safety guidelines for the AI agent, explicitly forbidding the auto-filling of sensitive legal or personal data and requiring mandatory user confirmation for all critical fields. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.