← 返回 Skills 市场

Filed — US Business Entity Search

Name: Filed — US Business Entity Search
Author: mgrantley

作者 mgrantley · GitHub ↗ · v1.0.1 · MIT-0

cross-platform ⚠ suspicious

239

总下载

当前安装

版本数

在 OpenClaw 中安装

/install filed

功能描述

Search and retrieve US business entity data (LLCs, corporations, partnerships) from official Secretary of State records via the Filed.dev API. Use when looki...

使用说明 (SKILL.md)

Filed — Business Entity Lookup

Search 1.9M+ US business entities from official state records.

Setup

An API key is required. Get one free (100 lookups/month) at https://filed.dev/register

Store the key in environment variable FILED_API_KEY or pass via --api-key.

Quick Reference

# Search by business name
scripts/filed.sh search --name "Acme Holdings" --state FL

# Search by registered agent
scripts/filed.sh search --agent "CSC Global" --state FL

# Search by officer name
scripts/filed.sh search --officer "John Smith" --state NY

# Get full entity details (officers, filings, addresses)
scripts/filed.sh entity ent_mNqR7xKp

# Filter by status and type
scripts/filed.sh search --name "Acme" --state FL --status active --type llc

# Filter by formation date
scripts/filed.sh search --name "Acme" --state FL --formed-after 2020-01-01

Supported States

FL, NY, PA, CT, CO, OR, IA, AK — more added regularly.

Response Fields

Search results return: id, name, state, type, status, formedDate, registeredAgent (name + address), principalAddress, officerCount.

Entity details add: stateEntityId, officers[] (name + title), filings[] (type + date).

Paid Plans

Plan	Lookups/month	Price
Free	100	$0
Pro	1,000	$49/mo
Ultra	10,000	$199/mo
Mega	50,000	$499/mo

Upgrade at https://filed.dev/pricing or via RapidAPI: https://rapidapi.com/grantley-holdings-grantley-holdings-default/api/filed2

API Details

For full endpoint docs, parameter reference, and error codes: references/api-docs.md

安全使用建议

This skill appears to do only what it claims: query the Filed.dev API using FILED_API_KEY and curl. Before installing, verify you trust filed.dev and are comfortable sending business-query payloads to that service. Prefer setting FILED_API_KEY in your environment rather than passing it on the command line (to avoid shell history / process-list exposure). Be aware the script will use python3 and jq if present for URL-encoding and pretty output (they are optional), and test the script in a safe environment first. If you need higher assurance, confirm the filed.dev domain, pricing, and privacy policy before provisioning an API key.

功能分析

Type: OpenClaw Skill Name: filed Version: 1.0.1 The skill bundle contains a command injection vulnerability in `scripts/filed.sh`. The script attempts to URL-encode user-provided search parameters (like `--name`, `--agent`, and `--officer`) by unsafely interpolating them into a `python3 -c` command string, which allows for arbitrary code execution if a crafted input is provided. While this is a significant security flaw, it appears to be a poorly implemented utility rather than an intentional backdoor, as the rest of the code aligns with the stated purpose of interacting with the Filed.dev API.

能力评估

✓ Purpose & Capability

Name/description match the included script and docs. The only required credential is FILED_API_KEY and the declared required binary is curl, both appropriate for an HTTP API client to filed.dev.

ℹ Instruction Scope

SKILL.md and scripts/filed.sh stick to search and entity retrieval from filed.dev. The script reads only FILED_API_KEY (declared). Note: the script optionally uses python3 for URL encoding and jq for output formatting if present, but those are not listed in required bins; the script falls back to simpler behavior if they are absent. Also avoid passing the API key on the command line (the script supports --api-key), since command-line args can be recorded in shell history or process lists.

✓ Install Mechanism

This is instruction-only with an included shell script; there is no install spec, no downloads, and nothing is written to disk beyond the script itself. Low install risk.

✓ Credentials

Only FILED_API_KEY is required (declared as primaryEnv). No other credentials or unrelated environment variables are requested. That is proportionate to the described functionality.

✓ Persistence & Privilege

always:false and normal user-invocable/autonomous invocation defaults. The skill does not request persistent system privileges, nor does it modify other skills or system-wide configs.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install filed
安装完成后，直接呼叫该 Skill 的名称或使用 /filed 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.1

Add metadata.openclaw declaring FILED_API_KEY as required credential

v1.0.0

Filed 1.0.0 — Initial Release - Instantly search and verify over 1.9 million US LLCs, corporations, and partnerships from Secretary of State records in FL, NY, PA, CT, CO, OR, IA, and AK. - Retrieve full entity details including officers, registered agent, filings, and addresses. - Search by business name, registered agent, officer name, status, type, or formation date. - Requires a Filed.dev API key (free tier available). - Simple CLI command set for quick queries and data filtering.

元数据

Slug filed

版本 1.0.1

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 2

常见问题