黄历查询
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a straightforward Huangli lookup tool that uses a disclosed external API token; review the token and base URL setup before use.
This skill is reasonable to install if you are comfortable using the nongli.skill.4glz.com API. Set HUANGLI_TOKEN only from the official dashboard, keep it secret, and avoid changing HUANGLI_BASE unless you trust the replacement endpoint.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The API token can authorize use of the user's Huangli service account or quota, and query requests are sent to the configured API host.
The tool reads a bearer token from the environment and sends it as an Authorization header to the configured API base. This is expected for the advertised Huangli API service, but users should treat the token as sensitive and keep the base URL trusted.
base = os.environ.get("HUANGLI_BASE", BASE_DEFAULT).rstrip("/")
token = os.environ.get("HUANGLI_TOKEN", "")
...
headers = {"Authorization": f"Bearer {token}"}Use a dedicated HUANGLI_TOKEN, do not share it, and leave HUANGLI_BASE set to the official HTTPS API unless intentionally using a trusted compatible endpoint.
A user relying only on registry requirements might not realize before installation that an API token is needed.
The registry requirement metadata does not reflect the runtime instructions in SKILL.md that require HUANGLI_TOKEN and Python. This is a packaging/metadata mismatch rather than hidden behavior, because the skill documentation and code disclose the token use.
Required env vars: none Env var declarations: none Primary credential: none
Update registry metadata to declare HUANGLI_TOKEN and the Python runtime requirement so the install-time contract matches SKILL.md.