xiaojia-skills

Call the JustAI openapi async chat endpoints and return structured JSON results. Use when Codex needs to invoke the deployed JustAI agent for marketing plans...

Before installing or using this skill: - Expect to set JUSTAI_OPENAPI_BASE_URL and JUSTAI_OPENAPI_API_KEY in your environment; the code will exit if they're not present even though the registry metadata doesn't list them. This mismatch is likely an oversight but you should be aware. - The scripts will send your prompts, conversation_id, and any provided project_id/skill_id to the configured base URL. Only use a base URL and API key you trust (preferably a well-audited internal or vendor endpoint). - Inspect the bundled scripts (they are small and readable) before running them in a sensitive environment. They use urllib to POST JSON; no other hidden network calls or file exfiltration are present in the code. - Limit the scope of the API key you provide (use least privilege) and avoid putting broad or long-lived org-level keys into this skill if possible. - Because the source/homepage is unspecified in the registry, consider installing from the upstream repository referenced in README (verify its authenticity) or obtain the code via a verified source. - If you need stricter controls, run the scripts in an isolated environment/container or use a proxy to monitor outbound requests to the configured base URL. If you want, I can list the exact lines that require the env vars and the network endpoints the scripts will call.

Type: OpenClaw Skill Name: xiaojia-skills Version: 1.0.0 The xiaojia-skills bundle is a legitimate integration for the JustAI OpenAPI, providing scripts (chat.py, list_projects.py, etc.) to perform asynchronous chat tasks and resource management. It correctly handles API authentication via environment variables and uses standard Python libraries for network communication without any evidence of malicious behavior, data exfiltration, or prompt injection.