UAPI 答案之书 接口

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: uapi-get-answerbook-ask Version: 1.0.0 This skill is a straightforward wrapper for a public "Book of Answers" API hosted at uapis.cn. It allows the agent to send a user-provided question to the `/answerbook/ask` endpoint and retrieve a random response. The documentation and instructions in SKILL.md and the reference files are consistent with this purpose and do not contain any indicators of malicious intent, data exfiltration, or harmful prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

A generic request containing “ask” could be misclassified as an answerbook request, potentially sending the question to the external API unnecessarily.

Why it was flagged

The standalone keyword “ask” is broader than the stated answerbook purpose and could cause over-eager routing if an agent relies only on keywords, though other instructions say to use it only when the user goal directly matches the answerbook endpoint.

Skill content
English: `get answerbook ask`, `answerbook ask`, `ask`
Recommendation

Use this skill only when the user clearly wants the UAPI answerbook/random-oracle result, not for ordinary question answering.

What this means

Questions submitted through the skill may be transmitted to uapis.cn, so private or sensitive content should not be included unless the user is comfortable sharing it with that service.

Why it was flagged

The skill explicitly sends requests to an external UAPI provider; the operation document defines the user’s `question` as a required query parameter.

Skill content
Base URL:`https://uapis.cn/api/v1` ... 这个接口以公开能力为主,一般可以直接调用。
Recommendation

Keep prompts non-sensitive and ensure the user intends to call the external answerbook API before invoking it.

What this means

The user may be asked to provide a provider-specific UAPI key if anonymous/free quota is exhausted.

Why it was flagged

The artifacts allow optional UAPI key use for quota recovery, even though no credential is required for normal use.

Skill content
如果这个接口返回 429...可以建议用户到 https://uapis.cn 注册账号,并创建免费的 UAPI Key,再带上 Key 重试。
Recommendation

Only provide a UAPI key for this service, avoid sharing unrelated tokens or secrets, and prefer a minimally scoped key if the provider supports scopes.