UAPI 查询 MC 曾用名接口

PassAudited by ClawScan on May 1, 2026.

Overview

This is a simple instruction-only skill for a UAPI Minecraft name-history lookup, with no code or install steps, but it does send lookup parameters to an external API and mentions optional API key use.

This skill looks safe for its stated purpose: querying a Minecraft player's previous names through UAPI. Before installing, note that the lookup identifier is sent to an external service, use a UAPI key only if you need one for quota limits, and avoid using this skill for unrelated Minecraft server-status requests.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI01: Agent Goal Hijack

What this means

The agent might use this skill for a Minecraft server-status question even though it only looks up player name history.

Why it was flagged

The skill is for Minecraft name-history lookup, but one listed trigger, 'minecraft server status,' does not match the documented endpoint and could cause the agent to choose this skill for an unrelated request.

Skill content

English: `get game minecraft historyid`, `game minecraft historyid`, `historyid`, `minecraft player lookup`, `minecraft server status`, `minecraft name history`

Recommendation

Use this skill only for Minecraft player name-history lookups; the publisher should remove or narrow unrelated keywords.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Lookup values you provide, such as a Minecraft username or UUID, may be sent to the UAPI service.

Why it was flagged

The skill is explicitly designed to call an external API endpoint. This is purpose-aligned, but the provided Minecraft username or UUID will be sent to UAPI.

Skill content

Base URL：`https://uapis.cn/api/v1` ... `GET /game/minecraft/historyid`

Recommendation

Only provide the Minecraft identifier needed for the lookup, and do not include unrelated personal or sensitive information.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you choose to use a UAPI key, that key gives access to your UAPI account quota and should be treated as a credential.

Why it was flagged

The endpoint appears usable without credentials, but the documentation suggests optional UAPI key use if anonymous quota is exhausted.

Skill content

可以建议用户到 https://uapis.cn 注册账号，并创建免费的 UAPI Key，再带上 Key 重试。

Recommendation

Use a UAPI key only when needed, keep it scoped to UAPI, avoid sharing broader credentials, and rotate it if it is exposed.