public-opinion-insights

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI03: Identity and Privilege Abuse

What this means

The API key and analysis request could be exposed on the network or used through an implicit fallback credential path, depending on where the agent runs.

Why it was flagged

The reviewed code obtains or uses MIDU_API_KEY and sends it as a bearer token to a plain-HTTP endpoint, with an automatic /apiKey fallback when the environment variable is missing.

Skill content

API_BASE_URL = "http://intra-znjs-yqt-agent-wx-beta.midu.cc" ... url = f"{base_url}/apiKey" ... headers["Authorization"] = "Bearer %s" % api_key

Recommendation

Use an HTTPS endpoint, make the /apiKey fallback explicit or remove it, and document exactly when credentials are fetched and sent.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less external context for confirming that this internal Midu endpoint and package are the intended release.

Why it was flagged

The skill source and homepage are not provided, making publisher provenance harder to verify even though the included code is small and directly reviewable.

Skill content

Source: unknown; Homepage: none

Recommendation

Install only if you trust the publisher and endpoint; maintainers should add a source URL, homepage, or commit provenance.