Zeelin Social Watch

Zeelin Social Watch: monitor social media sentiment, trending events, platform rankings, and account data via GSData open platform. Use when user asks for 舆情...

This skill appears to be a legitimate GSData API adapter, but there are a few red flags to consider before installing or supplying secrets: - Registry metadata omitted required env vars while SKILL.md does require GSDATA_APP_KEY and GSDATA_APP_SECRET. Treat that as an administrative inconsistency — confirm the required credentials before use. - The adapter code defines a fallback credential file path (~/.config/gsdata/credentials.json) that the SKILL.md does not mention. Check whether that file exists on your system and what it contains; the skill may read it automatically. - The default API URL in code is HTTP (not HTTPS). If you provide live credentials, they may be transmitted in plaintext unless you override the base URL to an HTTPS endpoint. Prefer using a scoped/test key with limited permissions. - The mapping includes many endpoints including write operations; SKILL.md instructs to require explicit confirmation for writes. Enforce that: never run write actions unless you review and explicitly allow them. - Practical steps: inspect the bundled gsdata_adapter.py and mapping file locally, verify how credentials are loaded, consider running the adapter in a confined environment, and only provide a GSData API key with minimal privileges (or a test key) until you are confident. Given these inconsistencies (metadata vs SKILL.md, undocumented credential file, and use of HTTP), treat the skill as suspicious until you verify those points.

Type: OpenClaw Skill Name: zeelin-social-watch Version: 0.1.0 The skill is a legitimate API adapter for the GSData (清博大数据) social media monitoring platform. The bundled Python script (gsdata_adapter.py) implements standard authentication and signature logic to interact with the official GSData gateway (databus.gsdata.cn). It includes safety-conscious features such as a built-in write-protection mechanism that blocks state-changing requests unless an explicit flag is provided, and the SKILL.md instructions correctly guide the agent to limit payload sizes and perform dry runs. No evidence of malicious execution, data exfiltration, or harmful prompt injection was found.