← 返回 Skills 市场

Dievio Lead Search API

Name: Dievio Lead Search API
Author: hundevmode

作者 hundevmode · GitHub ↗ · v1.0.3

cross-platform ⚠ suspicious

438

总下载

当前安装

版本数

在 OpenClaw 中安装

/install dievio-lead-search-api

功能描述

Run Dievio lead search and LinkedIn lookup workflows through the public API with correct authentication, filters, pagination, and credit-aware handling. Use...

使用说明 (SKILL.md)

Dievio Lead Search Api

Overview

Use this skill for end-to-end Dievio API execution: authenticate requests, submit lead searches, enrich LinkedIn profiles, and paginate results. Prefer the bundled script for deterministic request formatting and response handling.

Core Endpoints

Public lead search: POST https://dievio.com/api/public/search
LinkedIn lookup: POST https://dievio.com/api/linkedin/lookup

Authentication headers (use one):

Authorization: Bearer YOUR_API_KEY
X-API-Key: YOUR_API_KEY

Workflow

Validate credentials:

Require DIEVIO_API_KEY for API-key flows.
Never print raw secrets.

Build request body:

Search endpoint uses pagination keys (_page, _per_page, max_results) plus filters.
LinkedIn lookup requires linkedinUrls and optional output flags.

Execute request and parse response:

Validate success, count, has_more, next_page, data arrays.
Respect credit behavior: low credits can return fewer rows than requested.

Handle errors:

401: missing/invalid credentials
402: insufficient credits
502: upstream lead service issue
500: server error

Commands

Show help:

python3 scripts/dievio_api.py --help

Search with JSON body:

export DIEVIO_API_KEY="your_api_key"
python3 scripts/dievio_api.py search \
  --body-file ./search_body.json \
  --auto-paginate

By default the CLI prints a safe summary. Use --raw-output only when you explicitly need full rows (which may contain emails/phones).

LinkedIn lookup from URLs:

python3 scripts/dievio_api.py linkedin-lookup \
  --linkedin-url "https://www.linkedin.com/in/example-1" \
  --linkedin-url "https://www.linkedin.com/in/example-2" \
  --include-work-emails \
  --include-personal-emails \
  --only-with-emails

Decision Rules

Use search when query is filter-based lead discovery.
Use linkedin-lookup when input is explicit LinkedIn profile URLs.
For large pulls, enable pagination and stop on has_more=false.
Keep outputs structured and include paging fields for traceability.
If user asks for exact filter values, read references/filters-cheatsheet.md.

References

API contracts: references/api-reference.md
Filter fields and allowed values: references/filters-cheatsheet.md
Pagination behavior: references/pagination.md
Error handling guidance: references/errors.md

安全使用建议

This skill appears to do what it claims: it calls Dievio endpoints and needs only DIEVIO_API_KEY. Before installing: (1) verify the publisher/repo (SKILL.md references a GitHub repo but registry metadata lacks a homepage/source), (2) only provide an API key you trust and, if possible, a limited-scope or test key, (3) avoid using --raw-output unless you need full rows (it can include emails/phones/PII and could be logged), and (4) be aware the skill will perform network requests to dievio.com and will consume your Dievio credits. If you need stronger safety, restrict autonomous invocation or review the referenced GitHub repository to confirm code provenance.

功能分析

Type: OpenClaw Skill Name: dievio-lead-search-api Version: 1.0.3 The skill is classified as suspicious due to a Local File Inclusion (LFI) vulnerability in `scripts/dievio_api.py`. The `_load_json_file` function, used by `cmd_search` and `cmd_linkedin_lookup` via the `--body-file` argument, allows reading arbitrary JSON files from the local filesystem. While the script's core functionality is legitimate API interaction, an attacker could exploit this vulnerability through prompt injection against the OpenClaw agent to read sensitive JSON configuration or credential files, potentially exposing their contents if the agent is instructed to output the full response (especially with `--raw-output`). There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints or backdoor installation.

能力评估

ℹ Purpose & Capability

Name, README, SKILL.md, and the included Python CLI all consistently implement Dievio lead search and LinkedIn lookup via POST to dievio.com endpoints. The only mild inconsistency: registry metadata lists source/homepage as unknown/none while SKILL.md/README provide a GitHub URL and dievio.com homepage — worth verifying but not suspicious by itself.

✓ Instruction Scope

SKILL.md instructs the agent to authenticate with DIEVIO_API_KEY, build request payloads, paginate, and handle errors. The bundled script implements those steps and only reads local JSON body files and the DIEVIO_API_KEY environment variable; it does not attempt to read other system files or unrelated environment variables. SKILL.md warns not to print secrets and notes raw output may include emails/phones.

✓ Install Mechanism

No install spec; skill is instruction-only with a small Python script included. No downloads from arbitrary URLs or archive extraction are present. Risk from installation is low (script runs from disk if executed).

✓ Credentials

Only requires a single API key (DIEVIO_API_KEY), which is appropriate for an API-integration skill. The script allows an --api-key override and otherwise reads os.getenv('DIEVIO_API_KEY'); no other credentials or secrets are requested or accessed.

✓ Persistence & Privilege

Skill does not request persistent/always-on inclusion (always: false) and does not modify other skills or system-wide settings. It can be invoked autonomously by the agent (default behavior) but that is expected for a callable skill; no elevated privileges requested.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install dievio-lead-search-api
安装完成后，直接呼叫该 Skill 的名称或使用 /dievio-lead-search-api 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.3

Security hardening follow-up: fixed host pinning and default-safe output.

v1.0.2

Security hardening: remove DIEVIO_BASE_URL override; summary output by default; raw payload now explicit via --raw-output.

v1.0.1

Declare required DIEVIO_API_KEY metadata (source/homepage) and unify CLI auth mode names.

v1.0.0

Initial release: Dievio lead search and LinkedIn lookup skill with filters, pagination, and CLI.

元数据

Slug dievio-lead-search-api

版本 1.0.3

许可证 —

累计安装 0

当前安装数 0

历史版本数 4

常见问题