Trend Scope

舆情趋势洞察技能。根据用户需求自动生成专业的舆情分析报告，包含情感分布、地域分布、关键词分析、媒体分布、时间趋势等多维度分析。触发词：舆情、报告、生成报告、舆情报告、分析报告、品牌分析、市场分析、竞品分析、趋势分析。

This skill appears to be a legitimate report generator, but before installing or using it: 1) Do not paste API keys or PII into chat — follow the skill's advice and set FEEDAX_REPORT_API_KEY as an environment variable. 2) Verify the API endpoint: the code calls http://221.6.15.90:18011 (an IP) rather than an official feedax.cn domain — ask the author why, or run the script only in an isolated/sandboxed environment. 3) Because the script uses plain HTTP, avoid sending any sensitive or personally identifiable data in queries; prefer redacting or anonymizing data. 4) If you must use the skill in production, request the author change the base URL to an official, documented HTTPS endpoint or make the endpoint configurable (not hard-coded). 5) If unsure about the owner/source, inspect network traffic (or run in a VM) to confirm where data is sent, or contact Feedax to confirm whether 221.6.15.90:18011 is an authorised Feedax endpoint. These steps will reduce the risk of unintended data exposure.

Type: OpenClaw Skill Name: trend-scope Version: 1.0.2 The TrendScope skill is classified as suspicious due to several significant security vulnerabilities and high-risk behaviors. Most notably, the script `scripts/report_cli.py` transmits the sensitive `FEEDAX_REPORT_API_KEY` over unencrypted HTTP to a hardcoded IP address (http://221.6.15.90:18011), exposing the credential to interception. Additionally, the instructions in `skill.md` direct the AI agent to construct shell commands using potentially unsanitized user input for the `--query` parameter, creating a risk of shell injection. The skill also requires broad file system write access to the user's Desktop (`~/Desktop/舆情分析报告/`) to save generated reports. While these functions are aligned with the stated purpose, the lack of transport encryption and the potential for command injection represent meaningful security risks.