← 返回 Skills 市场
136
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install uapp-umini
功能描述
友盟小程序统计查询技能，支持通过 umeng-cli call 调用友盟 OpenAPI（gateway.open.umeng.com）的 12 个只读接口，覆盖小程序应用概况、累计用户、留存、页面分析（受访/入口）、分享分析（概况/页面/用户）、自定义事件（列表/统计/属性/属性值分布）。当用户需要了解小程序的...
安全使用建议
This skill uses the official umeng-cli to run read-only Umeng queries (which is coherent), but the SKILL.md mandates running 'umeng-cli trace' telemetry calls — including one that will include the AppKey (dataSourceId) you provide. Before installing or invoking: 1) Decide whether you are comfortable sending your AppKey to Umeng via the CLI trace endpoint; treat AppKey as sensitive. 2) Inspect what 'umeng-cli trace' does (review the @umengfe/umeng-cli source or documentation) and confirm where telemetry is sent and whether it logs other credentials. 3) Prefer to run the skill in an isolated environment or sandbox if you must test it, and only run 'umeng-cli login' interactively after understanding credential storage. 4) Ask the skill author to make telemetry optional (or at least opt-in and clearly documented) and to explicitly disclose what data is sent. If you do not consent to telemetry of AppKey/usage, do not run the prescribed 'umeng-cli trace' commands and consider using the CLI manually for queries instead.
功能分析
Type: OpenClaw Skill
Name: uapp-umini
Version: 1.2.0
The skill bundle contains instructions in `SKILL.md` that direct the AI agent to automatically execute telemetry commands (`umeng-cli trace`) whenever a user provides an AppKey (dataSourceId). This is a form of prompt injection designed to exfiltrate user-provided identifiers to an external tool's tracking backend without explicit user consent. While the core functionality for querying Umeng analytics appears legitimate, the automated side-channel data collection of sensitive application identifiers is a privacy and security risk.
能力评估
Purpose & Capability
The skill is an instruction-only wrapper around the official umeng-cli to call Umeng's umini read-only APIs — requiring umeng-cli and documenting npm install and the GitHub homepage is coherent with the stated purpose. However, the SKILL.md also mandates running 'umeng-cli trace' calls (telemetry), which is not part of basic read-only query functionality and is not declared in the top-level requirements.
Instruction Scope
The SKILL.md instructs the agent to immediately run 'umeng-cli trace {"skill_name":"..."}' when reading the document and to send an additional 'trace' containing the user's AppKey before the first API call that uses that AppKey. That causes the agent to collect and transmit user-provided identifiers (AppKey/dataSourceId) to Umeng and is outside of simply performing the requested read-only queries. The instructions therefore instruct explicit data transmission of user-provided values and add scope creep (telemetry/exfiltration) that isn't necessary for answering queries.
Install Mechanism
There is no install spec in the bundle itself; the SKILL.md recommends 'npm install -g @umengfe/umeng-cli' and points to a GitHub homepage. This is a standard public npm package and a reasonable installation mechanism for the described CLI use; no high-risk arbitrary download URLs or archive extraction are present.
Credentials
The skill declares no required environment variables or credentials, yet the runtime instructions explicitly require the agent to transmit the user's AppKey (dataSourceId) via 'umeng-cli trace'. Sending AppKey values is sensitive and the skill does not disclose or justify this telemetry in the top-level metadata. Additionally, it instructs running 'umeng-cli login', which will persist AK/SK in the CLI cache — acceptable for operation but something users should be warned about.
Persistence & Privilege
The skill does not request 'always: true', does not modify other skill configs, and is not installed as persistent system-level software by the bundle itself. Note: following the SKILL.md will cause umeng-cli to store credentials locally after login, which is normal for a CLI but should be considered by users.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install uapp-umini - 安装完成后，直接呼叫该 Skill 的名称或使用
/uapp-umini触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.2.0
**重大变更：Skill 全面切换至 umeng-cli 指令行调用方式，代码/SDK完全移除，仅保留说明文档。**
- 全部历史实现代码和 SDK 相关文件被移除（含 scripts 目录及 openapi SDK 全部文件）。
- Skill 说明文档升级为纯 CLI 接口说明，重命名为 umeng-cli-uapp-umini，版本号变为 1.0.0。
- 现仅支持通过 umeng-cli 调用友盟 OpenAPI 的 12 个只读接口，能力完全等价旧版，无扩展或额外功能。
- 场景分析类接口功能已迁移至 umeng-cli-uapp-mini-channel，不再随本 skill 发布。
- Skill 文档详细说明 CLI 安装、登录、调用方式，并指明仅支持小程序/H5/小游戏，不支持 App 端查询。
- 新增 umeng-cli trace 要求（埋点上报）；移除所有代码执行入口，需外部
v1.1.0
uapp-umini 1.1.0 更新说明
- 新增详细描述和即用型触发词，方便触发和理解 skill 适用场景
- 明确分步「使用流程」与常见问题处理流程，提升易用性与容错性
- 增补异常/边界条件说明（如应用类型、数据延迟、场景值查询等）
- 总结典型问法、CLI 参数映射、输出解读指导，支持更高效问答
- 保持所有查询参数、调用示例、注意事项与旧版一致，兼容原有功能
v1.0.0
Initial release of uapp-umini skill — 友盟小程序数据查询入口
- 支持小程序概况、留存、页面分析、分享、场景、自定义事件等数据查询
- 命令行参数丰富，涵盖常见核心分析需求
- 提供丰富的参数和详细示例，便于定制查询
- 支持数据分页、延迟说明及 JSON 结构化输出
- 多种配置方式，兼容环境变量与默认文件路径
元数据
常见问题
小程序数据问答 是什么？
友盟小程序统计查询技能，支持通过 umeng-cli call 调用友盟 OpenAPI（gateway.open.umeng.com）的 12 个只读接口，覆盖小程序应用概况、累计用户、留存、页面分析（受访/入口）、分享分析（概况/页面/用户）、自定义事件（列表/统计/属性/属性值分布）。当用户需要了解小程序的... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 136 次。
如何安装 小程序数据问答？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install uapp-umini」即可一键安装，无需额外配置。
小程序数据问答 是免费的吗？
是的，小程序数据问答 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
小程序数据问答 支持哪些平台？
小程序数据问答 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 小程序数据问答？
由 Umeng+（@squall0925）开发并维护，当前版本 v1.2.0。
推荐 Skills