shixinchao

测试-史新超

This skill is suspiciously inconsistent rather than overtly malicious. Before installing or providing secrets: (1) Do not provide your real API key yet — the registry metadata does not declare API_KEY. (2) Inspect and fix the code: program.py currently sets api_key = "" instead of reading os.environ['API_KEY'] (or similar), so authentication will fail or send an empty bearer token. (3) Confirm streaming behavior: requests.post is called with stream=False while the code iterates response.iter_lines() expecting SSE; change to stream=True and handle SSE properly. (4) Remember that user questions (potentially sensitive) will be sent to the external domain developer.jointpilot.com; only use a scoped/test key and review the remote service's privacy policies. (5) If you are not the developer, ask the publisher to (a) update the registry metadata to declare API_KEY as required, (b) correct program.py to read the env var and handle streaming, and (c) document what data is sent to the external API. If these issues are not resolved, treat the skill as untrusted.

Type: OpenClaw Skill Name: shixinchao Version: 1.0.1 The skill bundle is a test implementation for interacting with the JointPilot AI API (developer.jointpilot.com). While the Python script (scripts/program.py) contains a functional bug where it fails to actually retrieve the API_KEY from the environment as described in SKILL.md, the code logic is limited to standard API request handling and SSE stream parsing. There is no evidence of data exfiltration, malicious execution, or prompt injection.