Back to skill
Skillv1.0.0
ClawScan security
UAPI 必应壁纸 接口 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 7:31 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only skill that wraps a single public UAPI endpoint (GET /image/bing-daily); its declared requirements, instructions, and scope are consistent with that purpose and it does not request disproportionate privileges or secrets.
- Guidance
- This skill is an instruction-only wrapper for a single UAPI endpoint that returns Bing's daily image; it does not request credentials or install code by default. Before installing/using: confirm you trust the upstream host (https://uapis.cn), understand the image usage/licensing and rate limits, and only provide a UAPI Key if you expect authenticated requests. Because the skill can be invoked by the agent, be mindful that the agent may call the external endpoint when fulfilling user requests — this will transmit request parameters to the UAPI service (normal for an API wrapper). If you require stricter controls, avoid granting any service keys and require explicit user approval before outbound API calls.
Review Dimensions
- Purpose & Capability
- okThe skill's name and description map directly to a single API endpoint (GET /image/bing-daily). It declares no binaries, no environment variables, and no installs — all proportional to a small API-wrapper skill.
- Instruction Scope
- okSKILL.md instructs the agent to read the quick-start and operation docs, confirm parameters/auth, and call the endpoint. It does not ask the agent to read local files, other environment variables, or exfiltrate unrelated data.
- Install Mechanism
- okNo install spec and no code files are present (instruction-only). Nothing will be written to disk or downloaded during install.
- Credentials
- okNo required env vars or credentials are declared. The docs note that a UAPI Key may be needed if the service demands authentication — that is appropriate and limited to the service the skill targets.
- Persistence & Privilege
- okalways:false and default model invocation settings are used. The skill does not request permanent agent presence or system-wide configuration changes.