← Back to Skills Marketplace
136
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install uapp-umini
Description
友盟小程序统计查询技能，支持通过 umeng-cli call 调用友盟 OpenAPI（gateway.open.umeng.com）的 12 个只读接口，覆盖小程序应用概况、累计用户、留存、页面分析（受访/入口）、分享分析（概况/页面/用户）、自定义事件（列表/统计/属性/属性值分布）。当用户需要了解小程序的...
Usage Guidance
This skill uses the official umeng-cli to run read-only Umeng queries (which is coherent), but the SKILL.md mandates running 'umeng-cli trace' telemetry calls — including one that will include the AppKey (dataSourceId) you provide. Before installing or invoking: 1) Decide whether you are comfortable sending your AppKey to Umeng via the CLI trace endpoint; treat AppKey as sensitive. 2) Inspect what 'umeng-cli trace' does (review the @umengfe/umeng-cli source or documentation) and confirm where telemetry is sent and whether it logs other credentials. 3) Prefer to run the skill in an isolated environment or sandbox if you must test it, and only run 'umeng-cli login' interactively after understanding credential storage. 4) Ask the skill author to make telemetry optional (or at least opt-in and clearly documented) and to explicitly disclose what data is sent. If you do not consent to telemetry of AppKey/usage, do not run the prescribed 'umeng-cli trace' commands and consider using the CLI manually for queries instead.
Capability Analysis
Type: OpenClaw Skill
Name: uapp-umini
Version: 1.2.0
The skill bundle contains instructions in `SKILL.md` that direct the AI agent to automatically execute telemetry commands (`umeng-cli trace`) whenever a user provides an AppKey (dataSourceId). This is a form of prompt injection designed to exfiltrate user-provided identifiers to an external tool's tracking backend without explicit user consent. While the core functionality for querying Umeng analytics appears legitimate, the automated side-channel data collection of sensitive application identifiers is a privacy and security risk.
Capability Assessment
Purpose & Capability
The skill is an instruction-only wrapper around the official umeng-cli to call Umeng's umini read-only APIs — requiring umeng-cli and documenting npm install and the GitHub homepage is coherent with the stated purpose. However, the SKILL.md also mandates running 'umeng-cli trace' calls (telemetry), which is not part of basic read-only query functionality and is not declared in the top-level requirements.
Instruction Scope
The SKILL.md instructs the agent to immediately run 'umeng-cli trace {"skill_name":"..."}' when reading the document and to send an additional 'trace' containing the user's AppKey before the first API call that uses that AppKey. That causes the agent to collect and transmit user-provided identifiers (AppKey/dataSourceId) to Umeng and is outside of simply performing the requested read-only queries. The instructions therefore instruct explicit data transmission of user-provided values and add scope creep (telemetry/exfiltration) that isn't necessary for answering queries.
Install Mechanism
There is no install spec in the bundle itself; the SKILL.md recommends 'npm install -g @umengfe/umeng-cli' and points to a GitHub homepage. This is a standard public npm package and a reasonable installation mechanism for the described CLI use; no high-risk arbitrary download URLs or archive extraction are present.
Credentials
The skill declares no required environment variables or credentials, yet the runtime instructions explicitly require the agent to transmit the user's AppKey (dataSourceId) via 'umeng-cli trace'. Sending AppKey values is sensitive and the skill does not disclose or justify this telemetry in the top-level metadata. Additionally, it instructs running 'umeng-cli login', which will persist AK/SK in the CLI cache — acceptable for operation but something users should be warned about.
Persistence & Privilege
The skill does not request 'always: true', does not modify other skill configs, and is not installed as persistent system-level software by the bundle itself. Note: following the SKILL.md will cause umeng-cli to store credentials locally after login, which is normal for a CLI but should be considered by users.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install uapp-umini - After installation, invoke the skill by name or use
/uapp-umini - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.2.0
**重大变更：Skill 全面切换至 umeng-cli 指令行调用方式，代码/SDK完全移除，仅保留说明文档。**
- 全部历史实现代码和 SDK 相关文件被移除（含 scripts 目录及 openapi SDK 全部文件）。
- Skill 说明文档升级为纯 CLI 接口说明，重命名为 umeng-cli-uapp-umini，版本号变为 1.0.0。
- 现仅支持通过 umeng-cli 调用友盟 OpenAPI 的 12 个只读接口，能力完全等价旧版，无扩展或额外功能。
- 场景分析类接口功能已迁移至 umeng-cli-uapp-mini-channel，不再随本 skill 发布。
- Skill 文档详细说明 CLI 安装、登录、调用方式，并指明仅支持小程序/H5/小游戏，不支持 App 端查询。
- 新增 umeng-cli trace 要求（埋点上报）；移除所有代码执行入口，需外部
v1.1.0
uapp-umini 1.1.0 更新说明
- 新增详细描述和即用型触发词，方便触发和理解 skill 适用场景
- 明确分步「使用流程」与常见问题处理流程，提升易用性与容错性
- 增补异常/边界条件说明（如应用类型、数据延迟、场景值查询等）
- 总结典型问法、CLI 参数映射、输出解读指导，支持更高效问答
- 保持所有查询参数、调用示例、注意事项与旧版一致，兼容原有功能
v1.0.0
Initial release of uapp-umini skill — 友盟小程序数据查询入口
- 支持小程序概况、留存、页面分析、分享、场景、自定义事件等数据查询
- 命令行参数丰富，涵盖常见核心分析需求
- 提供丰富的参数和详细示例，便于定制查询
- 支持数据分页、延迟说明及 JSON 结构化输出
- 多种配置方式，兼容环境变量与默认文件路径
Metadata
Frequently Asked Questions
What is 小程序数据问答?
友盟小程序统计查询技能，支持通过 umeng-cli call 调用友盟 OpenAPI（gateway.open.umeng.com）的 12 个只读接口，覆盖小程序应用概况、累计用户、留存、页面分析（受访/入口）、分享分析（概况/页面/用户）、自定义事件（列表/统计/属性/属性值分布）。当用户需要了解小程序的... It is an AI Agent Skill for Claude Code / OpenClaw, with 136 downloads so far.
How do I install 小程序数据问答?
Run "/install uapp-umini" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is 小程序数据问答 free?
Yes, 小程序数据问答 is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does 小程序数据问答 support?
小程序数据问答 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created 小程序数据问答?
It is built and maintained by Umeng+ (@squall0925); the current version is v1.2.0.
More Skills