Umeng Stats

Query Umeng (友盟) app statistics including U-APM crash/error data and U-App analytics. Covers: crash stats, ANR counts, error trends, affected users, daily ac...

This skill appears to implement legitimate Umeng API calls, but there are red flags you should consider before installing: 1) The repository includes plaintext Umeng credentials (apiKey and apiSecurity) in config.json — treat those as sensitive and do NOT assume they are safe to reuse. If these are real credentials, they should be rotated and removed. 2) The Python script uses an absolute, user-specific CONFIG_PATH (/Users/zhangjing/...) that differs from the SKILL.md's workspace-relative path. That means the script may read a file from a specific home directory rather than the skill's workspace; this is a concrete risk (it may access files outside the expected directory) and a packaging bug. 3) The project source is 'unknown' with no homepage or publisher info — exercise extra caution with credentials and provenance. Recommendations: - Do not install blindly. Inspect and (ideally) run the code in an isolated environment (sandbox/container). - Remove or replace the embedded credentials: move apiKey/apiSecurity into secure environment variables or a workspace-protected config and update the script to read the workspace-relative path (or honor SKILL.md). - If you are the owner of the listed Umeng accounts, rotate the apiSecurity if you suspect it was leaked. - If you need this skill, request a version from a trusted source or modify the script to use a configurable path and environment-backed secrets before enabling it. - Absence of scanner warnings does not imply safety; the path/credentials issues are visible in the files and are the key concerns.

Type: OpenClaw Skill Name: umeng-stats Version: 1.0.0 The skill bundle contains hardcoded API credentials (apiKey and apiSecurity) in config.json and a hardcoded absolute file path (/Users/zhangjing/...) in scripts/query_crash.py. While the script's logic appears to legitimately query the Umeng API (gateway.open.umeng.com), the inclusion of private credentials and local environment paths constitutes a significant security risk and a functional vulnerability for any user other than the original author.