← 返回 Skills 市场
企查查
作者
bigxiaoxin
· GitHub ↗
· v1.2.1
497
总下载
0
收藏
1
当前安装
6
版本数
在 OpenClaw 中安装
/install qichacha
功能描述
根据公司名称查询企业基本信息、知识产权（专利/商标/著作权），数据来源企查查、天眼查等。
安全使用建议
Before installing or running this skill: 1) Review qichacha.js yourself (or have someone you trust do so) — it contains a hard‑coded Tavily API key; consider removing or rotating that key if you control it. 2) Be aware that running npm install will fetch dependencies and package tarballs (package-lock.json points to HTTP mirrors), which increases the risk of tampered packages — prefer running in a sandbox or verifying package integrity. 3) If you require guarantees about data handling, prefer skills that ask you to provide your own API credentials (instead of embedding a vendor key) or that call the official public sites directly. 4) If unsure, do not run npm install or run the script on an isolated machine/container and monitor outbound network traffic (api.tavily.com).
功能分析
Type: OpenClaw Skill
Name: qichacha
Version: 1.2.1
The skill contains a hardcoded Tavily API key in `qichacha.js`, which is a significant security vulnerability (credential leak). While the script's logic is consistent with its stated purpose of querying enterprise information by using the Tavily search API to aggregate data, the inclusion of static credentials and the use of unencrypted HTTP mirrors in `package-lock.json` (mirrors.tencentyun.com) are high-risk practices.
能力评估
Purpose & Capability
The skill claims to query public company info from sources like 企查查/天眼查; the implementation instead proxies queries through a third‑party service (api.tavily.com). Using an aggregator is plausible, but the code also lists an unused dependency (node‑fetch) in package.json — a minor mismatch but not directly harmful.
Instruction Scope
SKILL.md instructs the agent/user to run npm install and execute qichacha.js — that matches the included code. The README references direct data sources (企查查/天眼查) but the runtime actually sends search queries to Tavily; SKILL.md does not mention this external service or the embedded API key.
Install Mechanism
There is no formal install spec, but SKILL.md tells users to run npm install in the skill directory. package-lock.json records dependencies and resolved tarball URLs that point to mirrors.tencentyun.com via plain HTTP; fetching packages over HTTP increases tampering risk. Also the code does not use the declared dependency (node‑fetch), so npm install will pull unused packages.
Credentials
The skill requests no user credentials, which is reasonable, but it hard‑codes a Tavily API key inside qichacha.js. Embedding a third‑party API key in source is unexpected (and could expose that key or allow the maintainer to observe all queries). The skill does not require or ask for the user's credentials — which reduces direct exfil risk — but the presence of a secret in code is a proportionality/privacy concern.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide settings, and is user-invocable only. It does perform network calls at runtime (to api.tavily.com), which is expected for a lookup skill.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install qichacha - 安装完成后，直接呼叫该 Skill 的名称或使用
/qichacha触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.2.1
新增结构化输出、知识产权信息（专利/商标/著作权）
v1.3.0
新增结构化输出、知识产权信息（专利/商标/著作权）
v1.2.0
新增结构化输出、知识产权信息（专利/商标/著作权）
v1.1.0
移除收费功能，免费测试中
v1.0.1
修复 ES module 兼容性问题
v1.0.0
首次发布：支持企业名称查询，集成 SkillPay 收费
元数据
常见问题
企查查 是什么？
根据公司名称查询企业基本信息、知识产权（专利/商标/著作权），数据来源企查查、天眼查等。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 497 次。
如何安装 企查查？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install qichacha」即可一键安装，无需额外配置。
企查查 是免费的吗？
是的，企查查 完全免费（开源免费），可自由下载、安装和使用。
企查查 支持哪些平台？
企查查 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 企查查？
由 bigxiaoxin（@bigxiaoxin）开发并维护，当前版本 v1.2.1。
推荐 Skills