UAPI 查询 MC 玩家接口

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill coherently wraps a single UAPI Minecraft player lookup, with no code or install behavior; users should only note the external API use, optional UAPI key, and slightly overbroad keywords.

This looks safe to use for its narrow purpose: querying Minecraft player information through UAPI. Before using it, confirm the request is actually a player userinfo lookup, be aware that the queried username goes to UAPI, and only provide a UAPI-specific key if quota limits require it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Minecraft player lookup requests are handled by UAPI, so the queried username is shared with that external service.

Why it was flagged

The skill is designed to call a third-party UAPI endpoint rather than perform the lookup locally, so the Minecraft lookup value is sent to that provider.

Skill content

方法：`GET` ... 路径：`/game/minecraft/userinfo` ... Base URL：`https://uapis.cn/api/v1`

Recommendation

Use it only for Minecraft player lookups you are comfortable sending to UAPI, and avoid including unrelated personal or sensitive information.

Note

ASI03: Identity and Privilege Abuse

What this means

If quota limits are hit, the user may be asked to provide a UAPI key, which can identify their UAPI account and consume their quota.

Why it was flagged

No credential is required at install time, but the instructions may lead the agent to request or use a UAPI key if anonymous quota is exhausted.

Skill content

可以建议用户到 https://uapis.cn 注册账号，并创建免费的 UAPI Key，再带上 Key 重试。

Recommendation

Provide only a UAPI-specific key if needed, keep it revocable, and do not paste unrelated account credentials or secrets.

Note

ASI09: Human-Agent Trust Exploitation

What this means

The skill may be selected for a Minecraft server-status or name-history request even though the artifacts only document a username-to-UUID/skin lookup.

Why it was flagged

The server status and name history triggers are broader than the documented single player-userinfo endpoint, which could cause the agent to choose this skill for unsupported Minecraft tasks.

Skill content

Use when the user wants ... minecraft player lookup, minecraft server status, minecraft name history ...

Recommendation

Use this skill for Minecraft player userinfo lookups only; choose another tool for server status or name history.