提供结构化中国法律条文检索API，按次付费，数据自动更新，支持实时查询最新法律法规内容。

Key points before installing or running this skill: - Secrets and config: The code expects a config.py containing MEILISEARCH_HOST, MEILISEARCH_MASTER_KEY and (optionally) X402_WALLET_PRIVATE_KEY/X402_WALLET_ADDRESS. The package metadata does not declare these env vars — treat this as a manual configuration step. Do NOT paste any private key you care about into config.py without reviewing the code. - Exposed secret file: The repo includes moltbook-credentials.json with an API key and other identifying fields. That file appears unrelated to the core service and may be a leaked credential. Remove or rotate any keys found in the repo before using, and do not publish that file. - Payment recipient: SKILL.md and main.py are written to accept payments to whatever private key/address is configured. If you run this service, ensure the configured wallet is yours; if you use the included example or developer-supplied values, payments may go to the developer. Verify config.py.example and never use third-party private keys. - Network actions: update_database.sh and utility scripts clone GitHub repos and the code can call ModelScope snapshot_download — these operations fetch external content. Run the import/update steps in an isolated environment and audit the imported data before indexing. - Audit and harden before production: Remove sensitive artifacts (moltbook-credentials.json), declare required env vars in your deployment, avoid storing private keys in plaintext (use environment variables or a secrets manager), and validate config.py.example contents. Consider running the service in a sandbox/VM and monitoring outbound network traffic the first time you run it. - If you need a short checklist: inspect config.py.example, delete/rotate any credentials in the repo, run imports in isolation, set Meilisearch master key to a strong value, and only configure your own wallet private key if you understand the payment flow and trust the code. Because of undeclared credential requirements and an included secret file, this skill is internally inconsistent and could lead to accidental key leakage or misdirected payments — proceed only after the fixes and audits above.

Type: OpenClaw Skill Name: legal-cn-api Version: 1.0.0 The skill bundle implements a Chinese law search API with a micro-payment layer (x402 protocol), but exhibits high-risk credential handling. It explicitly instructs the user or agent to store a wallet private key in a plaintext configuration file (config.py) and includes a hardcoded API key in 'moltbook-credentials.json'. While these elements support the stated purpose of hosting a paid API, the requirement for sensitive private keys and the presence of hardcoded secrets are significant security vulnerabilities that could be exploited for credential theft in an AI agent environment.