读取橙丁物联液位传感器设备状态。使用场景：(1)查询液位传感器在线状态 (2)获取设备开关状态 (3)定时监控液位设备。需要提前配置 key、tel、imei 参数。

This skill appears to perform legitimate queries against a vendor API, but it has several things you should consider before running or installing it: - Do not paste real keys/phone numbers into the script file in plaintext. Instead, modify the script to read KEY, TEL, and IMEI from environment variables or a protected config file, or prompt at runtime. - The script uses jq (and curl). Ensure jq is installed from a trusted package source before running. The skill metadata should list these dependencies but does not — treat that as an omission. - Verify the endpoint (https://www.cd6969.com) is the legitimate vendor service you expect. If you do not recognize the domain, validate with the device vendor or use network isolation/testing with dummy credentials. - Review the script locally before executing. It is short and readable; ensure it only posts the device key/tel and parses the response as shown. - For safer testing, use dummy values and run in an isolated environment (container/VM) first. If you plan to use this skill long-term, ask the publisher to: declare required binaries (curl, jq), provide a secure configuration method (env vars or secret store) rather than hard-coded credentials, and include a brief security note about what data is sent to the vendor endpoint.

Type: OpenClaw Skill Name: chengding-level-sensor Version: 1.0.0 The `scripts/get_status.sh` script makes an external network call to `https://www.cd6969.com` to retrieve sensor data, which aligns with the skill's stated purpose. However, the script directly interpolates user-provided `KEY` and `TEL` values into a JSON string for the `curl -d` argument without proper sanitization. This lack of input sanitization creates a vulnerability where special characters in these inputs could lead to malformed JSON or potential JSON injection, classifying the skill as suspicious.