（司库系统）API 全生命周期管理智能 Skill

（司库系统）API 全生命周期管理智能 Skill

This skill appears coherent for documenting and testing PSBC treasury APIs. Before running anything: 1) Review and run the Python scripts locally in a sandboxed environment—they will read apis.json/response-codes.json and may attempt network calls if you call send_request or run the curl example. 2) Do not supply real private keys or production credentials until you have reviewed and replaced the TODO stubs for cryptographic operations; the client currently raises NotImplementedError for SM2/SM4 and private-key handling. 3) Confirm the origin/trustworthiness of this package (source is unknown) before using against production endpoints (production base_url is present). 4) If you need to validate messages or mock responses, prefer running validator.py/mock.py in an isolated test environment and avoid invoking send_request() against the production URL. 5) The pre-scan 'base64-block' flag is expected given the API's use of Base64-encoded payloads; it's not by itself an indication of malicious intent.

Type: OpenClaw Skill Name: psbc-treasury-api Version: 1.0.1 The skill bundle provides a comprehensive toolkit for managing and testing the PSBC (Postal Savings Bank of China) Treasury API. It includes detailed API specifications (apis.json), a message validator (validator.py), a mock server (mock.py), and client templates (psbc_client.py). No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the code uses legitimate bank-related domains and follows the stated purpose of API lifecycle management.