通过内部 API 模糊查询药品名称并返回其通用名，支持准确或模糊匹配。

This skill appears functionally correct for querying an internal drug-info API, but it embeds a hard-coded API token in tool.sh. That token is sensitive: if the skill bundle is shared, uploaded, or run in an environment you don't fully control, the token could be exposed or abused. Before installing: (1) ask the provider to remove the token and instead require you to supply a token via an environment variable or a secure secret store; (2) if removing the token isn't possible, treat the token as compromised and rotate it on the API side; (3) only run the skill on hosts that have network access to 10.1.23.216 and are trusted; (4) verify the token's scope/expiry with your API admin and ensure least privilege; (5) consider auditing access logs for the internal API after first use. If you cannot confirm safe handling of the embedded token, avoid installing or sharing this skill.

Type: OpenClaw Skill Name: 216medsearch Version: 1.0.0 The skill contains a hardcoded API token (JWT) and targets an internal private IP address (10.1.23.216) in tool.sh, which exposes internal infrastructure credentials. Additionally, the script lacks input sanitization for the medicine name parameter, which is directly interpolated into the curl POST data, creating a risk of parameter injection. These are significant security vulnerabilities, though they appear to be unintentional flaws rather than active malware.