wjx-cli-use
v0.1.21Guide for using wjx-cli (Wenjuanxing CLI) to create surveys, query responses, and analyze data. Use when the user mentions: 问卷, 调查, 收集, 表单, 投票, 考试, 测评, 满意度,...
⭐ 0· 86·0 current·0 all-time
by@orzwq
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the actual contents: SKILL.md, reference docs, examples, and helper scripts all focus on using wjx-cli to create/manage surveys, responses, contacts and do local analytics. The included setup and packaging scripts are consistent with packaging/installation of a CLI guide.
Instruction Scope
SKILL.md explicitly instructs the agent to install Node.js, run `npm install -g wjx-cli`, execute wjx commands (init/doctor/create-by-text/etc.), and open the browser to obtain an API key. It also instructs the agent not to show CLI commands in user-facing replies (unless the user asks). These instructions are within the stated purpose, but they give the agent the ability to run system commands and write credentials (via wjx init) — expected for a CLI integration but worth noting for transparency.
Install Mechanism
There is no registry install spec in metadata (skill is instruction-only), but setup.sh will perform a global npm install of the third‑party package wjx-cli (and suggests NodeSource curl|bash commands in docs). Installing a global npm package is expected for a CLI, but it is a moderate-risk action compared with an instruction-only skill because it pulls code from the npm registry and can modify the system environment.
Credentials
Metadata declares no required env vars/config paths, yet SKILL.md and scripts reference WJX_API_KEY, WJX_CORP_ID and the user config file ~/.wjxrc (wjx init writes credentials). The absence of declared required env vars/config paths in registry metadata is an inconsistency you should be aware of. The requested credentials (an API key and optional corp id) are proportionate to the skill's purpose, but they will be stored/used locally and are not declared up-front.
Persistence & Privilege
always is false and the skill does not request system-wide persistent privileges or attempt to modify other skills. The setup script creates or reads the user-level ~/.wjxrc and installs a CLI — normal for this functionality.
Assessment
This skill is a documentation/automation guide for the wjx-cli and appears to do what it claims, but review these before installing or running the bundled setup script: 1) The skill will prompt to install Node.js and run `npm install -g wjx-cli` (global npm installs modify your system — inspect the wjx-cli package on npm/GitHub before installing). 2) It expects you to obtain and provide a WJX API Key (and optionally a WJX_CORP_ID); those credentials will be stored/used locally (wjx init writes ~/.wjxrc). The registry metadata did not declare these env/config requirements — confirm you are comfortable providing the API key. 3) The setup guidance references NodeSource curl|bash commands in docs (a common convenience but potentially risky); avoid blindly piping remote scripts to sh — use official installers or your package manager. 4) If you want more transparency, don’t allow the agent to run setup.sh unattended: instead retrieve the API key yourself and run commands in a controlled environment, or ask the assistant to show the exact commands before it executes them. If you plan to let the agent run commands autonomously, verify the upstream wjx-cli package source and consider running the install in an isolated environment.Like a lobster shell, security has layers — review code before you run it.
latestvk9752dcvx914v3xf52yxs7hvk584x4fv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.