App基础指标+智能巡检(异动报告)

查询友盟 (UMeng) 应用统计数据分析，支持通过 APPKEY 获取应用的基础指标信息如新增用户数、活跃用户数等。当用户提到"友盟"、"umeng"、"APPKEY"、"新增用户"、"活跃用户"或需要查询应用统计数据时使用此技能。

This skill is an Umeng (友盟) Python SDK and legitimately needs your Umeng apiKey and apiSecurity. However: (1) the skill's metadata does not declare those required credentials even though SKILL.md and the code expect them — treat this as a red flag and do not supply secrets without inspecting the code; (2) the code will look for a config file in the current directory, your home directory, or the skill directory — check those locations for accidental credential leakage and do not store long-lived secrets in shared repos; (3) review umeng_config.py and umeng_get_outlier_points.py to confirm credentials are only used to call Umeng endpoints (gateway.open.umeng.com / mobile.umeng.com) and not exfiltrated elsewhere; (4) prefer running the code in a restricted/sandboxed environment and set file permissions (chmod 600) on any config file; (5) ask the publisher to update the skill metadata to list required env vars (UMENG_API_KEY, UMENG_API_SECURITY) and clarify automatic loading behavior — if they do and code audit is clean, the mismatches here would be resolved and the skill would be coherent.

Type: OpenClaw Skill Name: umeng-api Version: 1.0.0 The skill provides a Python SDK and wrapper for UMeng (友盟) application analytics. It is classified as suspicious due to a security vulnerability in `umeng_get_outlier_points.py`, which transmits the `api_security` key as a plaintext query parameter in a GET request to `mobile.umeng.com`. This practice risks credential exposure via server logs, browser history, or network interception. While the rest of the bundle (including the `aop` SDK) appears to follow standard API signing practices and includes security advice for managing configuration files, the credential leakage vulnerability meets the criteria for a suspicious classification.