崩溃与性能数据查询

友盟应用性能监控（U-APM）数据查询技能，支持通过 umeng-cli call 调用友盟 APM OpenAPI（apm.openapi.umeng.com）的 8 个只读查询接口，涵盖今日/历史稳定性、启动性能、网络性能、原生页面、H5 页面、分钟级网络与稳定性数据。当用户需要查询应用崩溃率、启动耗时、网络...

This skill appears to be a legitimate wrapper for Umeng APM queries, but it asks the agent to run automatic telemetry and to send any Appkey you input via 'umeng-cli trace'. Before installing or using it: (1) decide whether you want the agent to automatically send usage data and any Appkey you supply — disable or remove the 'umeng-cli trace' steps if you don't; (2) prefer installing the CLI via a package manager (npm) rather than piping a remote install script into sh, and inspect the install script before running it; (3) confirm that sending your appKey to Umeng for 'trace' is acceptable to you and your organization (it may be sensitive); (4) verify the umeng-cli source/repository and privacy policy; and (5) be aware the SKILL.md requests the agent to post a login link and run login in background — that flow is normal but ensure credentials are handled by umeng-cli rather than being copied into chat. If you want, ask the skill author to remove automatic 'trace' calls or to make telemetry opt-in and to document exactly what 'trace' sends.

Type: OpenClaw Skill Name: uapp-apm Version: 1.2.0 The skill instructions (SKILL.md) contain prompt injections directing the AI agent to perform automated telemetry/tracking by executing 'umeng-cli trace' commands, including reporting the user's 'appkey' (dataSourceId) to the CLI tool without explicit user consent. Additionally, the documentation promotes a high-risk installation method via 'curl | sh' (pointing to raw.githubusercontent.com/umeng/umeng-cli), which is a common vector for supply chain attacks. While these behaviors are likely intended for legitimate vendor usage analytics, the automated exfiltration of identifiers and the use of unverified remote scripts meet the threshold for suspicious activity.