Mysteel_InfoSearch

大宗商品行业资讯查询技能。用于查询钢铁、有色、能源化工等行业的动态新闻、市场快讯、政策变化、企业消息、价格异动分析、供需事件等资讯信息。当用户需要：(1) 了解行业最新动态和新闻；(2) 查询政策法规变化；(3) 获取企业生产经营消息；(4) 分析价格异动原因；(5) 跟踪供需事件；(6) 进行市场跟踪和研究支持...

What to consider before installing or running this skill: - Functionality: This skill simply queries Mysteel's AI search API (https://mcp.mysteel.com/...) and returns JSON results — that matches the description. - API key handling: The SKILL.md says it will prompt you and save an API key to references/api_key.md if the file is missing, but the actual script does not implement prompting or writing; it only reads references/api_key.md and exits if the key is missing. If you expect interactive prompting, the code will not do that. You should create references/api_key.md manually with your API key (one line) before running. - Secret storage: The API key is stored as plaintext in references/api_key.md. If you store a real credential there, limit exposure: set file permissions (e.g., chmod 600), keep keys scoped/rotated, and avoid sharing the project directory. - Network calls: The script makes POST requests to an external endpoint. Only provide an API key you trust the external service with; do not reuse high-privilege credentials (e.g., AWS keys) here. Review and confirm the domain is correct for the service you intend to use. - Code review: The Python script is short and uses only the stdlib; you can inspect/modify it easily (for example add secure prompting and avoid writing the key to disk). If you want prompting behavior, implement it yourself or modify the script to securely prompt and store keys with better protections. - When to avoid installing: Do not install or run this skill if you cannot verify the source of your Mysteel API key, if you must not store secrets in plaintext in the environment, or if network calls to external endpoints are disallowed in your environment. If you want me to, I can: - show an edited version of the script that prompts securely and avoids writing the key to disk; - suggest a safer pattern for storing the key (environment variable or OS keyring) and demonstrate how to adapt the script; - or verify that the endpoint URL and API header format match documentation you provide.

Type: OpenClaw Skill Name: mysteel-infosearch Version: 1.0.0 The skill is a legitimate tool for querying commodity industry information from the Mysteel API. The Python script `scripts/search.py` uses standard libraries to perform authenticated POST requests to a specific, relevant domain (mcp.mysteel.com) and contains no evidence of malicious execution, data exfiltration, or obfuscation.