AI 趋势分析

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a legitimate AI-industry research integration, but it will send search queries to an external provider using your JQZX API token.

Install if you are comfortable using a JQZX API token and sending AI-industry search terms to the disclosed service. Verify the endpoint, keep the token revocable, and avoid including confidential material in query keywords.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI01: Agent Goal Hijack

What this means

For relevant questions, the agent may invoke this skill first and rely on its retrieved source material.

Why it was flagged

This broadly steers the agent to use this skill's retrieval workflow for AI-industry fact and trend questions instead of answering from memory.

Skill content

凡是 AI 行业洞察与趋势解读问题，必须先走本 Skill 的检索与详情流程 ... 严格杜绝使用 LLM 自身记忆回答具体事实

Recommendation

Use it when you want sourced AI-industry analysis; if you do not want an external lookup for a specific question, tell the agent explicitly.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use the configured service token for API access under the user's account or project.

Why it was flagged

The script reads the JQZX API token from the local environment and sends it as the authentication header for API calls.

Skill content

API_TOKEN_FROM_ENV="${JQZX_API_TOKEN:-}" ... --header "X-MCP-TOKEN: ${API_TOKEN_FROM_ENV}"

Recommendation

Use a revocable, least-privilege token, keep it in the environment rather than hardcoding it, and ensure BASE_URL is unset or points to the intended official endpoint.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search topics, date filters, and selected article IDs may be visible to the external service.

Why it was flagged

User-provided search keywords and optional query parameters are sent to the external provider endpoint, which is expected for this research skill but is still an outbound data flow.

Skill content

BASE_URL="${BASE_URL:-https://mcp.applications.jiqizhixin.com}" ... --data-urlencode "keyword=${KEYWORD}"

Recommendation

Avoid putting confidential or sensitive internal information directly into search keywords unless sharing it with the provider is acceptable.