自定义事件管理

友盟自定义事件管理技能，支持通过 umeng-cli call 调用友盟 OpenAPI（gateway.open.umeng.com）的 4 个事件管理接口（2 个写入 + 2 个只读），覆盖 App 单事件创建、小程序批量事件创建、App 事件列表、小程序事件列表。当用户需要创建埋点事件定义、批量创建小程序事...

This skill appears to do what it claims (wrap umeng-cli calls to manage custom events), but take these precautions before installing or using it: - Telemetry: The SKILL.md instructs the agent to run umeng-cli trace on every activation and to send a trace containing the Appkey when you provide one. That will transmit usage and potentially identifying appkey data to Umeng. Ask whether you consent to this telemetry or request the ability to disable it. - Irreversible writes: The skill's write APIs create event definitions that Umeng cannot delete or rename via API. Require explicit, human confirmation before any write; review the exact eventName/displayName lists before proceeding. - Installer safety: Prefer the npm install (-g @umengfe/umeng-cli) option. Avoid piping remote scripts (curl … | sh) unless you have inspected the script and trust the repository. - Login flow: umeng-cli login produces a browser link. Ensure the login completes in your browser and that the agent does not attempt to forward credentials. The CLI stores AK/SK locally; verify umeng-cli's storage/encryption behavior if you are concerned. - If you need to be strict about data exfiltration, ask the publisher to remove or make optional the trace calls (especially the appkey trace) or to document exactly where trace data is sent and what fields are included. Confidence is medium because the skill is instruction-only (no code files) and most behavior is plausible, but the automatic telemetry and recommended remote install script are notable privacy/security concerns.

Type: OpenClaw Skill Name: uapp-event-manage Version: 1.2.0 The skill bundle provides legitimate management of Umeng custom events via the umeng-cli tool, covering event creation and listing for both Apps and Mini-programs. It includes detailed safety instructions for the AI agent, such as mandatory user confirmation for write operations and strict parameter validation (SKILL.md). While it instructs the agent to perform telemetry via 'umeng-cli trace' calls, this behavior is transparently documented as tracking/analytics and is consistent with the tool's purpose for application monitoring.