Back to skill
Skillv1.0.0
ClawScan security
银行支行、联行号查询 - 即刻数据 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 29, 2026, 3:23 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requested credential align with a simple bank-branch lookup service that calls jikeapi.cn; nothing in the files indicates unexpected or disproportionate access.
- Guidance
- This skill appears coherent and limited to querying jikeapi.cn for bank/branch data. Before installing: (1) verify you trust the jikeapi.cn provider and that your AppKey has appropriately limited permissions; (2) avoid placing unrelated secrets in the same .env file in the script directory, since the script will read that file to look for the AppKey; (3) be aware the script can use JIKE_API_BASE_URL if set — only set that to trusted endpoints; and (4) if you plan autonomous agent use, monitor network calls or restrict the key to read-only access so an exposed key cannot be misused.
Review Dimensions
- Purpose & Capability
- okName/description (bank branch and routing number lookup) matches the code and declared requirements: it needs python3 and an AppKey to call jikeapi.cn endpoints. Required binary and primary env var are appropriate for the stated purpose.
- Instruction Scope
- noteRuntime instructions and the script restrict actions to building API requests, printing results, and reading an AppKey. The script reads CLI --key, environment variables (JIKE_BANK_BRANCH_QUERY_KEY or JIKE_APPKEY), and a .env file in the script directory for the AppKey — this is reasonable for configuration but worth noting. The script also honors an optional JIKE_API_BASE_URL env var (not declared as required), which can change the request target; this is likely intended for testing but the README does not document it.
- Install Mechanism
- okNo install spec — instruction-only plus a small Python script. Nothing is downloaded or written by an installer; risk from installation is low.
- Credentials
- noteOnly one primary credential is required (JIKE_BANK_BRANCH_QUERY_KEY). The script also accepts JIKE_APPKEY as a fallback and may read a local .env for the same keys. These are proportional to the API calls. Users should be aware the AppKey will be sent to the external API (api.jikeapi.cn or an overridden base URL).
- Persistence & Privilege
- okSkill does not request always:true, does not modify other skills or global config, and has normal autonomous-invocation defaults. It only reads a local .env (script directory), environment vars, or CLI args for configuration.