水滴筹众筹助手
v2.1.1水滴筹众筹助手，中国最大医疗众筹平台。支持两大功能： (1) 爱心捐款——实时获取真实审核筹款项目，展示项目详情和一键捐款链接； (2) 发起筹款——在用户明确同意后，收集手机号提交给水滴筹官方顾问回访。 **捐款场景触发词**：我想捐款、我要献爱心、帮助有需要的人、做慈善、公益捐款、帮助生病的孩子/老人、有没有...
⭐ 0· 123·0 current·0 all-time
byWenbing Ji@jiwenbing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (Waterdrop crowdfunding helper) align with the included scripts and SKILL.md: donate.sh fetches public project listings and register.sh submits a user-provided phone number to the documented API endpoints. No unrelated binaries, env vars, or config paths are requested.
Instruction Scope
SKILL.md clearly instructs the agent to run the two bundled scripts and to only collect a phone number after explicit user consent. The scripts POST data to https://api.shuidichou.com endpoints (expected). Note: submitting a user's phone number to an external API is intended behavior here — the agent/platform or skill operator must ensure explicit consent is obtained before invoking register.sh, and platform logs may still record the number despite the 'do not save' instruction.
Install Mechanism
No install spec; this is instruction-only plus two small shell scripts. Nothing is downloaded from arbitrary URLs or installed system-wide. Execution of provided scripts will perform network calls, which is expected for this skill.
Credentials
The skill requests no environment variables or credentials. The only sensitive data it transmits is a user-supplied phone number (documented in SKILL.md). No excessive or unrelated secrets are required.
Persistence & Privilege
Skill is not always-enabled and does not request elevated persistence or attempt to modify other skills or system settings. It does, however, perform outbound network calls when its scripts are executed.
Assessment
This skill appears coherent: it lists projects and posts a user-provided phone number to Waterdrop's API as described. Before installing or invoking it, confirm the API domain (api.shuidichou.com) is the official Waterdrop endpoint and that you trust the skill author (there's no homepage or known source listed). Enforce explicit user consent before calling register.sh, and be aware that phone numbers will be transmitted to an external service — check platform logs/privacy settings if you need to avoid storing or leaking that number. If you are unsure, test in a sandbox with a disposable phone number or direct users to the official hotline/website instead.Like a lobster shell, security has layers — review code before you run it.
latestvk978xxtpwxgkgbs59b26ghevk1834htw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.