MeterSphere

本项目将 MeterSphere REST API 与本地脚本能力整合,为 OpenClaw Agent 提供了一套高效、可复用的 Skills,支持自动生成功能用例、接口定义及接口用例,查询组织、项目、模块、用例评审与缺陷关联等信息,简化了测试资产管理流程,提升了团队的自动化效率。

Before installing or running this skill: 1) Treat the registry metadata mismatch as a red flag — inspect skill-metadata.json and SKILL.md in the package to confirm which env vars and binaries it actually needs. 2) Run everything first in an isolated sandbox (non-production MeterSphere instance) and monitor outbound traffic to confirm requests only go to your configured METERSPHERE_BASE_URL. 3) Use least-privilege API keys: prefer read-only keys for queries and separate limited keys for write/create operations; rotate keys after testing. 4) Set METERSPHERE_DEFAULT_TEMPLATE_ID, METERSPHERE_DEFAULT_VERSION_ID and METERSPHERE_PROJECT_ID to avoid the hardcoded fallback values. 5) Do not set METERSPHERE_HEADERS_JSON unless you understand and trust every header being injected — it can be used to attach credentials to requests. 6) Protect the .env file (do not commit it; set permissions to 600); be aware scripts will load .env from the skill folder automatically. 7) Inspect the scripts that call openssl/curl and temporary-file handling (ms_batch.py, ms_generate.py, ms.py) to ensure they meet your environment policies. 8) If you are not comfortable with local signing using SECRET_KEY (even though the scripts claim not to transmit it), consider using a read-only approach and avoid providing a high-privilege secret to this skill. If you want, I can point out the exact lines/files implementing the hardcoded IDs, the openssl/curl calls, and the .env loading so you can review them closely.

Type: OpenClaw Skill Name: metersphere Version: 1.0.5 The bundle provides a legitimate integration for the MeterSphere REST API, enabling an AI agent to manage test cases, API definitions, and review workflows. While the scripts utilize high-risk capabilities such as executing system commands (curl, openssl) and handling sensitive API credentials (METERSPHERE_SECRET_KEY), these actions are well-documented and strictly aligned with the stated purpose of authenticating with and interacting with a MeterSphere instance. Notably, the package includes extensive security documentation (INSTALLATION_CHECKLIST.md, SIGNATURE_ALGORITHM.md) and a dedicated verification script (verify_installation.py) to help users mitigate risks like hardcoded IDs or insecure environment configurations. No evidence of data exfiltration, unauthorized persistence, or malicious prompt injection was found.