Mysteel_MarketAnalysis

大宗商品市场分析服务；当用户需要钢铁、有色、能源化工、炉料等品类的市场分析、行情跟踪或供需解读时使用

This skill is coherent with its stated purpose (calling Mysteel's analysis API and expanding the returned report), but take these precautions before installing: 1) Confirm you actually trust the endpoint https://mcp.mysteel.com and that you are allowed to send queries and confidential data to it. 2) Be aware the API key is stored in plaintext at references/api_key.md; consider storing secrets in a secure vault instead of a repo file. 3) The registry metadata omits that references/api_key.md is required—verify and update metadata or deployment procedures to avoid surprises. 4) Ensure the runtime has requests==2.31.0 installed or the script will fail. 5) If you do not have a Mysteel API key or don’t trust the source, do not provide a key; the skill enforces not answering without a valid key. If you want higher assurance, request the publisher to fix the metadata (declare the required config path), remove the plaintext key requirement, and document the exact API behavior and privacy guarantees.

Type: OpenClaw Skill Name: mysteel-marketanalysis Version: 1.0.0 The skill provides commodity market analysis by calling a remote API (mcp.mysteel.com). It uses the 'exec' tool to run a local Python script (scripts/analyze.py) which reads an API key from a local file (references/api_key.md). While the behavior aligns with the stated purpose, the instruction in SKILL.md to execute a shell command with user-controlled input ('--query "<query>"') presents a potential shell injection vulnerability. No evidence of intentional malice or data exfiltration was found.