Back to skill
Skillv1.0.0
ClawScan security
UAPI 查询 MC 服务器 接口 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 8:36 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This skill is an instruction-only wrapper for a single UAPI endpoint (GET /game/minecraft/serverstatus); its requirements and instructions match its stated purpose and it does not ask for unrelated credentials or install anything.
- Guidance
- This skill is narrowly scoped and coherent: it will prepare and/or call UAPI's GET /game/minecraft/serverstatus. Before installing, consider whether you trust requests to the third-party service https://uapis.cn (queries will include the server address you ask about). If you plan to check private/internal servers, be aware those addresses would be sent to UAPI. No credentials are required up front, but the skill may suggest adding a UAPI Key if you hit quota limits. If you need fully local or offline checks (no external API calls), this skill is not appropriate.
Review Dimensions
- Purpose & Capability
- okThe name/description and all included files consistently describe a single-purpose wrapper for the UAPI Minecraft server-status endpoint. No unrelated binaries, credentials, or config paths are requested.
- Instruction Scope
- okSKILL.md only tells the agent to pick this interface for matching user requests, confirm parameters and quotas, and consult the included reference docs. It does not instruct reading unrelated files, harvesting environment variables, or sending data to unexpected endpoints. It points to the UAPI base URL (https://uapis.cn) which is expected for this purpose.
- Install Mechanism
- okThere is no install spec and no code files to write or execute. This is instruction-only, so nothing is downloaded or installed.
- Credentials
- okThe skill declares no required environment variables or credentials. The docs note that a UAPI Key may be needed if quota is exceeded and mention Steam Web API keys only as a general caveat for other game endpoints—this is proportionate and informational, not a hidden requirement.
- Persistence & Privilege
- okalways is false and there is no attempt to modify other skills or system settings. agents/openai.yaml sets allow_implicit_invocation true, allowing the agent to pick this skill when relevant (normal behavior).