API接口文档助手。用于编写REST API文档、定义接口规范、生成接口说明。当需要编写API文档、接口规范时触发。

This skill's description promises an API documentation assistant, but the bundled Skill.py is a generic HTTP client able to call arbitrary URLs and send JSON. Before installing: 1) Ask the author why the skill needs to perform arbitrary HTTP requests and to document that behavior in SKILL.md. 2) Request that network behavior and required dependencies (requests) be declared. 3) If network calls are necessary (e.g., to fetch live examples), limit them to well-known endpoints and add allow-listing; otherwise remove or disable network capability. 4) If you proceed, run the skill in a sandboxed environment, disable autonomous invocation where possible, and review or audit the code to ensure it won't send sensitive data to external servers. If you cannot verify the intent and code, treat the skill as untrusted and do not install it in environments with sensitive data.

Type: OpenClaw Skill Name: api-test Version: 1.0.3 The skill bundle provides a generic HTTP client in 'Skill.py' that allows the agent to perform arbitrary GET and POST requests to any user-provided URL. This implementation lacks any domain whitelisting or input sanitization, creating a high risk for Server-Side Request Forgery (SSRF) attacks against internal or external resources. While the 'SKILL.md' describes the tool as an API documentation assistant, the underlying code is a broad network utility without safety constraints.